ClawHub
Back to skill

Security audit

Tencent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Tencent planning and research helper with disclosed local notes, limited source checks, and explicit approval requirements for account-changing work.

Install this if you want Tencent-specific planning help and are comfortable with local Tencent notes in ~/tencent and research queries to Tencent documentation sites. Do not store secrets in the skill memory, and verify publisher/version before installing any optional related skills it recommends.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:158
Finding

Unpinned Related Skill Installation Creates a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 158–164
Vulnerability Type: Unverified and unpinned third-party Skill installation
Risk Level: Medium

Vulnerable Code

markdown
## Related Skills
Install with `clawhub install <slug>` if user confirms:

- `cloud` - General cloud architecture and platform tradeoff guidance
- `cloud-storage` - Object storage design, migration, and operations patterns
- `payments` - Payment flow design, merchant risk checks, and launch discipline
- `in-depth-research` - Broader market and source-comparison workflows
- `market-research` - Competitive and market-level framing beyond product routing

Technical Analysis

The project recommends installing related Skills by mutable slug without specifying a trusted publisher, immutable version, integrity digest, or source-review procedure. User confirmation prevents silent installation, but it does not verify the provenance or integrity of the resolved package.

If a listed package is compromised, replaced, transferred to an untrusted publisher, or resolved from an unsafe source, the installed Skill may contain malicious instructions or executable components. Its effective capabilities depend on the host Agent and the permissions granted when that Skill is loaded.

Attack Path

  1. An attacker compromises, replaces, or gains control of one of the listed Skill slugs.
  2. A user receives the recommendation to install that related Skill.
  3. The user confirms installation, believing the slug identifies a trusted dependency.
  4. The Agent executes clawhub install &lt;slug&gt; without an immutable version or integrity check.
  5. The malicious or modified Skill is installed and subsequently loaded.
  6. Its instructions or bundled components may attempt to manipulate the Agent, access available data, invoke tools, or perform other actions within the Agent's granted permissions.

Impact Assessment

Successful exploitation could expose any files, tools, cre ...[truncated 483 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each recommended Skill to an immutable, reviewed version.
  2. Identify and verify the expected publisher for every dependency.
  3. Require cryptographic integrity or signature verification before installation.
  4. Display the resolved package source, publisher, version, and permissions before requesting approval.
  5. Review downloaded Skill instructions and bundled scripts before activation.
  6. Reject unexpected publisher changes, mutable aliases, unsigned artifacts, and integrity mismatches.
  7. Prefer a trusted allowlist or lockfile containing verified package identifiers and hashes.
  8. Run third-party Skills with least privilege and isolate their filesystem, network, memory, and tool access.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
- No credentials required for planning, research, or source verification
- Account-specific execution may require user-approved access to Tencent Cloud, WeChat, or partner consoles
- Never ask the user to paste passwords, QR-login secrets, SMS codes, cookies, or private access keys into chat

## Data Storage

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
This skill does NOT:
- store secrets in local markdown files
- claim a product is available everywhere without checking region
- log into Tencent surfaces without explicit user approval
- rewrite its own skill definition files

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 43)May include surrounding context.

bash
mkdir -p ~/tencent
touch ~/tencent/{memory.md,accounts.md,regions.md,sources.md,decisions.md}
chmod 700 ~/tencent
chmod 600 ~/tencent/{memory.md,accounts.md,regions.md,sources.md,decisions.md}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · setup.md (reported line 44)May include surrounding context.

mkdir -p ~/tencent touch ~/tencent/{memory.md,accounts.md,regions.md,sources.md,decisions.md} chmod 700 ~/tencent chmod 600 ~/tencent/{memory.md,accounts.md,regions.md,sources.md,decisions.md}

text

If `~/tencent/memory.md` is empty, initialize the baseline files from `memory-template.md`.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · source-validation.md (reported line 10)May include surrounding context.

md
1. Tencent-owned product docs and product pages
2. Tencent developer docs for the exact product family
3. Tencent partner or official announcement pages
4. Secondary analysis only to fill context gaps

Do not invert this order because a blog post is easier to read in English.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The question "Which language should docs and console steps use?" is followed by guidance that "English mirrors can lag or omit detail," which can steer the skill toward a specific language workflow. Because the file does not explicitly present language choice as user opt-in, this may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.