Security audit

MigraQ

Security checks across malware telemetry and agentic risk

Overview

MigraQ is a disclosed Tencent Cloud migration proxy, but it can forward broad prompts to Tencent services and use local cloud credentials for real resource-changing operations with limited per-action controls.

Install only if you are comfortable sending migration questions, inventories, billing details, and topology information to Tencent Cloud services. Use a least-privileged Tencent Cloud CAM key, avoid account-wide admin credentials, keep credentials out of persistent shell config when possible, clear sessions between projects, and require explicit review of exact resources, costs, and rollback steps before any authenticated create, modify, delete, cluster, or migration action.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The manifest and trigger language frame the skill as scanning, recommendation, and TCO analysis, but the instructions also authorize authenticated write operations such as creating, modifying, deleting resources, and initiating migrations. This is a significant scope escalation: a user may invoke what seems like an advisory skill but actually grant it the ability to perform destructive or costly cloud actions.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The documentation explicitly broadens the skill from advisory/presales use into operational actions such as migration execution and cluster management, which materially changes the trust boundary and risk profile. In an agent setting, this can cause the skill to be invoked for state-changing cloud operations without sufficiently clear authorization, scope controls, or safety constraints, increasing the chance of unauthorized or destructive actions.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script explicitly supports authenticated '迁移执行' style operations in addition to advisory/pre-sales flows, which expands the skill from information/recommendation into action-capable cloud operations. In this skill context, that scope expansion is risky because the manifest emphasizes scanning/recommendation/TCO triggers, so users and integrators may not expect a capability that can act on real cloud resources when credentials are present.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The code reads Tencent Cloud API credentials from environment variables to enable authenticated API calls, which is more sensitive than the advisory/pre-sales functionality described in the skill metadata. In this context, silently consuming ambient credentials increases the chance that a seemingly low-risk advisory skill can access privileged cloud capabilities without clear user awareness.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad everyday phrases such as '帮我推荐' and '给我推荐', which can cause accidental invocation outside the intended migration context. In a skill that can route prompts to remote services and, in some cases, progress toward authenticated cloud operations, overly broad triggers increase the risk of unintended data transmission or unsafe workflow activation.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.