Security audit

Tencent Docs

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Tencent Docs integration, but it needs review because it gives broad document-account control and includes unsafe update, deletion, URL-scraping, and credential-handling guidance.

Install only if you are comfortable granting this skill access to your Tencent Docs account. Before use, pin or review the mcporter dependency, avoid pasting browser cookies or raw tokens into prompts or scripts, require explicit confirmation before any delete or bulk change, and do not let the skill scrape or save URLs unless you intentionally want that URL and its content sent to Tencent Docs and stored as a cloud document.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Untrusted Remote Update Instructions Can Redirect Agent Behavior
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: references/api_references.md:518
Finding: Any Mentioned URL Triggers an Unrequested Remote Scrape and Cloud Write
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:9
Finding: Setup Installs an Unpinned npm Package Globally
Content: View full analysis
/dev/null; then echo "mcporter was not found; installing it..." npm install -g mcporter echo "mcporter installation completed" fi ``` The English comments and messages above preserve the behavior of the original snippet: when `mcporter` is absent, setup executes `npm install -g mcporter` without an exact version or integrity constraint. ### Technical Analysis The command resolves the mutable package name `mcporter` from npm at installation time. It does not specify: - An exact audited package version. - A lockfile. - An integrity hash. - Registry or publisher provenance requirements. - Disabled lifecycle scripts. - A project-local installation boundary. npm packages can run lifecycle scripts during installation. If the package, maintainer account, registry resolution, or a future release is compromised, installation can execute attacker-controlled code. Global installation increases the blast radius by placing the tool in a shared command search path and may require elevated privileges in some environments. The script only installs the package if no command named `mcporter` is already present. It does not validate that an existing command is authentic or compatible, although the audit found no local code that replaces the command. ### Attack Path 1. A user runs `bash setup.sh` on a system where `mcporter` is not installed. 2. npm resolves the current release associated with the unversioned `mcporter` package name. 3. A compromised or malicious release supplies package files or lifecycle scripts. 4. npm executes applicable installation scripts with the privileges of the user running setup. 5. The installed package is placed in a global location and is subsequently used with the user's Tencent D ...[truncated 875 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (29)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document begins operational instructions in Chinese ('每天使用 SKILL 前进行一次更新检查') and continues to present the skill guidance largely in Chinese, effectively imposing a specific language on users. The file does not state that Chinese is optional, nor does it offer an alternative language or opt-in choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill documents delete capability and notes recursive deletion (remove_type=all) but does not require an explicit confirmation step before destructive actions. In a document-management context, an agent following these instructions could delete folders or nested content based on ambiguous or mistaken user requests, causing irreversible data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documented manage.delete_file and manage.move_file workflows expose destructive or disruptive file-management actions without a clear warning about data loss, broken organization, or the need for confirmation. In this skill's context, these are high-risk capabilities because the tool can operate on real user documents and folders, so a mistaken search result or misunderstood request could impact important content at scale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill specification mandates Chinese outputs and examples such as Chinese titles, fonts, and response formats, but does not indicate that this is optional or limited to a China-specific workflow. SQP-3 applies because the file imposes a specific language/locale behavior without user opt-in or a clearly documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to send processed user document content to an external MCP service (tencent-docs / doc.ai_format_pure_text) but does not require any user notice, consent, or data-handling warning. Because the input is arbitrary user text and may contain contracts, government text, essays, or other sensitive material, this creates a real privacy and data-transmission risk rather than a purely theoretical issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instructions throughout the prompt require analysis and title generation in Chinese, including the fallback title "未命名文档", but do not provide any user opt-in or alternative language handling. This creates a language policy issue because the skill appears to impose a fixed locale on all inputs regardless of user preference or document language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instructions require the assistant to operate in Chinese and rely on Chinese字号,颜色,对齐方式 mappings throughout the prompt. This imposes a specific language/locale behavior without any user opt-in or documented region-specific justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The JSON template uses Chinese-only natural-language descriptions for document elements, which effectively constrains generated content to a specific language/locale. Under the policy, forcing a language without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This JSON manifest contains multiple natural-language description fields such as "公文标题", "主送机关", and "签发单位" that enforce a specific language/locale in the skill output. Because the file does not indicate user opt-in or clearly document that the template is intentionally limited to a Chinese government-document context, it creates a language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This JSON template hard-codes Chinese-only labels and regex patterns such as "摘要", "关键词", and later "目录", "参考文献", and "致谢", which imposes a specific locale on users. The file does not indicate that this is an optional or region-specific template, nor does it offer a language choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The parameter description for mermaid says the text must not contain Chinese, which is a locale/language constraint presented as a requirement rather than an optional or justified limitation. This is a natural-language policy issue because it forces a specific language behavior without offering user choice or documenting a necessary regional/compliance reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation instructs agents to automatically scrape any mentioned URL and states this is the only correct way to access external webpages, but it provides no privacy, consent, or data-classification guardrails. In an agent setting, that can cause unreviewed transmission of user-supplied or sensitive URLs to an external service and persistence of scraped content into documents without explicit user confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow describes searching for documents and then deleting them without any confirmation, preview, or warning about destructive effects. In an agent-assisted setting, this raises the risk of accidental or overbroad deletion if search results are ambiguous, manipulated, or misunderstood by the user or model.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs users to bypass the normal tool boundary and make direct HTTP requests to the MCP endpoint while supplying Authorization and Cookie headers. That expands the trust surface, encourages manual handling of sensitive session material, and can lead to credential leakage, replay, or use of unaudited code paths outside the intended agent/tool mediation layer.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation tells users to make direct HTTP calls using Authorization and Cookie headers but provides no warning about secure credential handling. That omission materially increases the chance that tokens or session cookies will be copied into prompts, scripts, logs, screenshots, or shared code, enabling account compromise or unauthorized document access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document explicitly describes destructive spreadsheet operations such as deleting rows/columns and deleting worksheets, but it provides no warning about irreversible data loss, backup expectations, or confirmation requirements. In an agent skill context, this omission can normalize unsafe automation and increase the chance that downstream agents or users invoke destructive actions without adequate safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The example command demonstrates worksheet deletion as a routine workflow without any explicit caution, confirmation step, or data-loss notice. Because examples are often copied verbatim into agents or operator playbooks, this increases the risk of accidental destructive execution against real documents.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation inconsistently uses properties.sheet_id to mean a worksheet name while the rest of the document defines sheet_id as an identifier. This can cause an agent or developer to send the wrong parameter, potentially creating, modifying, or targeting the wrong sheet and leading to unintended data operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The delete-table operation is documented as a normal action without any warning about irreversible data loss, confirmation requirements, or safeguards. In an agent setting, this increases the chance that automation will execute destructive actions on user data without adequate friction or review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Bulk field deletion removes schema elements and can also effectively destroy access to associated data, yet the documentation presents it without caution. This is risky for agent-driven workflows because a mistaken field ID list could corrupt the table structure at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Bulk record deletion is described without warning about irreversible removal of potentially large amounts of data. In an automation context, this omission makes accidental or overbroad deletions more likely, especially when record IDs are gathered programmatically from prior queries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The workflow explicitly recommends deleting default rows and columns as part of setup, but does not caution that these are irreversible structural and data changes. Because this appears in a prescriptive workflow, an agent may treat deletion as routine and perform it without checking whether the rows or columns are actually safe to remove.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's comments and all user-facing echo messages are written in Chinese, which imposes a specific language on users without any opt-in or fallback. This matches the policy category for language or locale violations because no user choice or justification for the locale restriction is provided in the file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: L25 明确规定 fontColor 应输出不带 # 的十六进制值，但 L42 和 L46 的示例输出却使用了带 # 的颜色值。这会让实际使用者或下游模型对预期输出格式产生混淆，属于文档与意图表达的直接矛盾。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This JSON manifest contains user-facing natural-language fields such as descriptions and examples exclusively in Chinese (for example at L07, L09-L10, and L17). Under the stated policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.