Skills/ClawHub/qwencloud-deploy

qwencloud-deploy@1.0.3

CAUTION· install only

Publisher claims: "One-click deploy, publish, and update a local project or Git repository to Alibaba Cloud International (alibabacloud.com), producing an accessible online service with a public IP. Supports full-stack ROS orchestration, automatic cloud-resource provisioning, pre-deployment price confirmation." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher cuixiaoyang123 · publishing for 58 daysInstalls 729Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-07 and scored it 68/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Access to sensitive file paths; Destructive file system command detected. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
File permission modification commandscripts/update_app.sh:100 · File permission modification command — agent changes file ownership/permissionschmod +x /usr/local/lib/docker/cli-plugins/docker-composeFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedscripts/update_app.sh:108 · Destructive file system command detectedrm -rf /opt/qwencloud.prevFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsscripts/update_app.sh:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files[ -f /etc/qwencloud/db.env ] && install -m 600 /etc/qwencloud/db.env ./.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/update_app.sh:86 · Destructive file system command detectedrm -f \"\$STAGING_DIR/app.tar.gz\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/update_app.sh:290 · Destructive command against a filesystem root or devicerm -rf \"\$STAGING_DIR\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathstemplates/userdata/docker.sh:85 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# compose auto-loads .env from the same directory; if RDS env exists, export it to .env.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Host or command assembled from base64 fragmentsscripts/generate_template.py:100 · Host or command assembled from base64 fragmentsf"echo '{encoded}' | base64 -d > /tmp/qwencloud-main.sh\n"Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
HIGH
Access to sensitive file pathsscripts/update_app.sh:112 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Keep .env perms in sync with db.env (0600): db.env holds the DB password, and aFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Destructive file system command detectedscripts/update_app.sh:81 · Destructive file system command detectedrm -rf \"\$STAGING_DIR\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedtemplates/userdata/nginx_static.sh:27 · Destructive file system command detectedrm -f /tmp/static.tar.gzFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/update_app.sh:201 · Destructive file system command detectedrm -rf /opt/qwencloud.failedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/update_app.sh:167 · Destructive file system command detectedrm -rf /opt/qwencloud.prevFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/update_app.sh:295 · Destructive command against a filesystem root or devicerm -f \"\$STAGING_DIR/app.tar.gz\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/update_app.sh:400 · Destructive command against a filesystem root or devicerm -rf \"\$STATIC_STAGING\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/update_app.sh:81 · Destructive command against a filesystem root or devicerm -rf \"\$STAGING_DIR\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
CRITICAL
Destructive command against a filesystem root or devicescripts/update_app.sh:86 · Destructive command against a filesystem root or devicerm -f \"\$STAGING_DIR/app.tar.gz\"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathstemplates/userdata/docker.sh:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesinstall -m 600 /etc/qwencloud/db.env ./.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_artifacts.py:70 · Python subprocess execution detectedreturn subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/generate_template.py:101 · File permission modification command — agent changes file ownership/permissionsf"chmod +x /tmp/qwencloud-main.sh\n"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Destructive file system command detectedtemplates/userdata/nginx_static_proxy.sh:29 · Destructive file system command detectedrm -f /tmp/static.tar.gzFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/wait_and_probe.py:33 · Python subprocess execution detectedresult = subprocess.run(cmd, capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_artifacts.py:119 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandscripts/generate_template.py:34 · File permission modification command — agent changes file ownership/permissions"{ touch /var/log/qwencloud-bootstrap.log; chmod 600 /var/log/qwencloud-bootstrap.log; }",Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_artifacts.py:99 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_artifacts.py:25 · Python subprocess execution detectedr = subprocess.run(cmd, shell=isinstance(cmd, str), check=check,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/upload_artifacts.py:53 · Python subprocess execution detectedr = subprocess.run(["aliyun", "ossadmin", "OpenOssService"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File permission modification commandtemplates/ros_single_rds.yaml:197 · File permission modification command — agent changes file ownership/permissions{ touch /var/log/qwencloud-bootstrap.log; chmod 600 /var/log/qwencloud-bootstrap.log; }Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtemplates/userdata/docker.sh:83 · File permission modification command — agent changes file ownership/permissionschmod +x /usr/local/lib/docker/cli-plugins/docker-composeFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtemplates/ros_single_rds.yaml:213 · File permission modification command — agent changes file ownership/permissionschmod 600 /etc/qwencloud/db.envFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtemplates/userdata/systemd.sh:97 · File permission modification command — agent changes file ownership/permissionschmod +x "$ARGV0" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandtemplates/userdata/systemd.sh:104 · File permission modification command — agent changes file ownership/permissionschmod +x "$ARGV0" 2>/dev/null || trueFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈1,767 tok
1 file · 39 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

12 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Destructive command against a filesystem root or device≈ +9 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  2. Unclaimed publisher≈ +8 on the totalClaim cuixiaoyang123: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  3. Obfuscated code≈ +5 on the totalRemove base64-assembled strings, eval of decoded text and minified blobs. Reviewers and scanners both treat unreadable code as hostile.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  6. Host or command assembled from base64 fragments≈ +4 on the totalPut hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim cuixiaoyang123Propose a patch to the maintainer
qwencloud-deploy@1.0.3 safety verdict: Caution (install only) — KillerSkills