ClawHub
Back to skill

Security audit

Orchestrator——Tencent——CodingPlan

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly an external Tencent orchestration tool, but its broad triggers and workspace-to-cloud routing deserve user review before installation.

Install only if you intentionally want Tencent Coding Plan to receive task prompts and selected workspace content for sub-agent work. Avoid using broad requests like delegate or parallel on sensitive projects unless you first confirm what files and messages will be sent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger list includes broad generic terms like 'delegate', 'parallel', and 'sub-agents', which can cause the skill to activate during ordinary user requests unrelated to external orchestration. In this skill's context, accidental activation is more dangerous because the skill can autonomously spawn sub-agents and transmit user prompts or workspace content to an external Tencent endpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
- "hunyuan-2.0-thinking"
            - "glm-5"
            - "kimi-k2.5"
          endpoint: "https://api.lkeap.cloud.tencent.com/coding/v3"
      capabilities:
        - "sessions_spawn"
        - "subagents"
Confidence
96% confidence
Finding
This skill is explicitly configured to send prompts and potentially workspace-derived content to an external API endpoint. External transmission is security-relevant here because the skill also advertises autonomous orchestration and sub-agent spawning, making data exfiltration possible if sensitive files are included in task context or triggered unexpectedly.

External Transmission

Medium
Category
Data Exfiltration
Content
dataAccess: "workspace"
      externalAccess: true
      externalEndpoints:
        - "https://api.lkeap.cloud.tencent.com/coding/v3"
      dataSentExternally:
        - "Task prompts"
        - "Workspace file contents (when included in task context)"
Confidence
99% confidence
Finding
The metadata declares workspace access, external access, and external transmission of task prompts, user messages, and workspace file contents. In combination, these capabilities create a clear path for sensitive local data to leave the environment, and the autonomous behavior increases the blast radius of mistaken or overly broad use.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill mixes English with mandatory Chinese instructions ('必读!') without any user opt-in, creating a risk that users or operators will misunderstand cost, consent, and data-transfer conditions. In a skill that can send workspace contents externally, unclear language increases the chance of uninformed consent and unsafe operation.

Static analysis

No suspicious patterns detected.