T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/check-qq-doc-updates.py:153- Finding
Unrestricted URL Fetching Enables SSRF and Local Resource Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Tencent Doc Update Watcher
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Tencent Docs update-checking purpose, but its script can fetch arbitrary configured URLs and optionally retain raw pages, headers, and cookies, so it needs review before installation.
Install only if you trust the configs you will run. Keep --keep-raw off unless debugging, and avoid using sensitive authenticated Tencent Docs links unless you are comfortable with local snapshot metadata. The publisher should constrain URLs to https://docs.qq.com, restrict curl protocols and redirects, and document the exact filesystem/network permissions expected.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/check-qq-doc-updates.py \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/check-qq-doc-updates.py \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/check-qq-doc-updates.py \
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs use of shell execution, network access, and file read/write behavior, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this creates an authorization gap: the runtime may allow broader capabilities than reviewers or users expect, increasing the risk of unintended outbound requests, unsafe filesystem access, or misuse of temporary workspaces.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run_cmd(cmd: list[str], timeout: int) -> tuple[int, str]: p = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
When --keep-raw is enabled, the script preserves raw HTML, headers, and especially cookie jar files on disk under the snapshot directory. Because this skill processes Tencent Docs content that may rely on authenticated access, retained cookie files and fetched artifacts can expose session material or sensitive document metadata to other local users, backups, or later unintended reuse.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file includes a section titled and written entirely in Chinese, but does not indicate that language selection is optional or provide equivalent opt-in guidance. This can conflict with language/locale policy requirements when a skill imposes or assumes a specific language without user choice.
- Content