Tencent Doc Update Watcher

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  0.1.1

Overview

This skill does what it says: it checks Tencent Docs for updates and writes local comparison reports, with raw fetched data deleted by default.

Before installing, make sure you are comfortable with a local Python script using curl to fetch the configured Tencent Docs links and writing snapshots under the workspace you choose. Review any custom config file, keep the workspace private, and avoid --keep-raw unless you specifically need debugging files because it can retain raw page, header, and cookie data locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform network access, shell execution, and file reads/writes, but it does not declare those permissions in the skill metadata. That mismatch weakens reviewability and least-privilege controls, making it easier for operators to invoke a capability-rich workflow without clear visibility into what access is required.

VirusTotal

65/65 vendors flagged this skill as clean.