ClawHub
Back to skill

Security audit

Tencent Docs Stable Channel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tencent Docs fallback workflow, but users should understand that it may send document content through a direct JSON-RPC path using configured credentials when the normal connector fails.

Install only if you want an agent to recover failed Tencent Docs writes by using your configured Tencent Docs/MCP credentials. Before relying on fallback, make sure the MCP gateway configuration points to a trusted endpoint and avoid using it for content you would not send to Tencent Docs through the normal connector.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly instructs a direct HTTP JSON-RPC fallback using runtime-resolved gateway configuration and existing credentials, but it does not require any user-facing notice or confirmation before transmitting document content outside the normal connector path. This can cause unintended disclosure of sensitive content or use of privileged configured credentials through an alternate channel that the user may not realize is being invoked.

Static analysis

No suspicious patterns detected.