Orchestrator——Tencent——CodingPlan

• Outcome: Review
• Latest audit: May 29, 2026 at 9:29 PM UTC
• Version:
  1.0.6

Overview

This skill appears purpose-built for multi-agent orchestration, but it needs review because broad triggers may cause workspace context to be sent to an external Tencent API while spawning sub-agents.

Review before installing. Use this only if you are comfortable with task prompts and selected workspace context being sent to the listed Tencent endpoint, and prefer explicit invocation plus per-task confirmation. Avoid using it in repositories containing secrets, credentials, customer data, or private business material unless file inclusion is tightly controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list includes broad natural-language terms such as 'parallel' and 'delegate' that are likely to appear in ordinary user requests. In a skill that can autonomously spawn sub-agents and transmit workspace content externally, accidental activation increases the chance of unintended orchestration and data disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

- "hunyuan-2.0-thinking"
            - "glm-5"
            - "kimi-k2.5"
          endpoint: "https://api.lkeap.cloud.tencent.com/coding/v3"
      capabilities:
        - "sessions_spawn"
        - "subagents"

• Confidence: 97% confidence
• Finding: https://api.lkeap.cloud.tencent.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

dataAccess: "workspace"
      externalAccess: true
      externalEndpoints:
        - "https://api.lkeap.cloud.tencent.com/coding/v3"
      dataSentExternally:
        - "Task prompts"
        - "Workspace file contents (when included in task context)"

• Confidence: 98% confidence
• Finding: https://api.lkeap.cloud.tencent.com/

VirusTotal

60/60 vendors flagged this skill as clean.