Tencent Cloud Lighthouse

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:08 PM UTC
• Version: 1.0.0

Overview

This skill is for Tencent Cloud Lighthouse administration, but it stores cloud API keys in plaintext and runs unpinned npm packages with those credentials, so users should review it carefully before installing.

Install only if you are comfortable giving this skill a Tencent Cloud API key and allowing npm-sourced code to run with that key. Use a dedicated least-privilege CAM identity, restrict or rotate credentials, check permissions on ~/.mcporter/mcporter.json, and prefer a pinned or locally reviewed MCP server package before using remote command or firewall operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:125

Finding

JavaScript Code Injection Through Unsafely Interpolated Setup Arguments

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:97

Finding

Unpinned npm Packages Are Downloaded and Executed During Setup and Runtime

Content

View full analysis

/dev/null; then echo "[OK] mcporter already installed" else echo "[INSTALL] Installing mcporter via npm..." npm install -g mcporter ``` The generated MCP configuration also invokes an unpinned package through `npx`: ```javascript config.mcpServers.lighthouse = { command: 'npx', args: ['-y', 'lighthouse-mcp-server'], env: { TENCENTCLOUD_SECRET_ID: '$SECRET_ID', TENCENTCLOUD_SECRET_KEY: '$SECRET_KEY' } }; ``` The newly generated configuration has the same behavior: ```json "lighthouse": { "command": "npx", "args": ["-y", "lighthouse-mcp-server"], "env": { "TENCENTCLOUD_SECRET_ID": "$SECRET_ID", "TENCENTCLOUD_SECRET_KEY": "$SECRET_KEY" } } ``` ### Technical Analysis Both npm dependencies are referenced only by package name. No exact version, integrity digest, lockfile, or trusted artifact checksum is used. `npm install -g mcporter` installs whichever version the configured registry currently resolves as current. Similarly, `npx -y lighthouse-mcp-server` can retrieve and execute a remotely supplied package without interactive confirmation. Consequently, the effective code executed by the skill can change after the audited skill package has been published. A compromised package publisher, npm account, registry, dependency, or package release could introduce code that is executed automatically. The MCP server receives Tencent Cloud API credentials in its environment, making compromise especially sensitive. ### Attack Path 1. An attacker compromises an upstream package, maintainer account, transitive dependency, or configured npm registry. 2. A malicious release becomes the version selected for `mcporter` or `lighthouse-mcp-server`. 3. The setup script ...[truncated 887 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:111

Finding

Tencent Cloud Credentials Are Stored in Plaintext Without Enforced Restrictive Permissions

Content

View full analysis

"$CONFIG_PATH" <

Remediation

View remediation

&2 exit 1 } ``` Further hardening should include: - Store credentials in an operating-system secret manager or Tencent-supported credential provider instead of directly in JSON. - Prefer short-lived credentials or role-based authentication. - Use a dedicated CAM identity with narrowly scoped Lighthouse permissions. - Avoid passing secrets on the command line; read them from a protected file descriptor, secret manager, or hidden prompt. - Validate that the destination is not a symbolic link and is a regular file owned by the current user. - Rotate any credentials that may already have been written with permissive permissions. - Never print credential values in logs or diagnostics. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill’s declared purpose emphasizes Lighthouse management, but its first-use flow collects Tencent Cloud SecretId/SecretKey and persists them into a local mcporter configuration file. That credential-handling behavior is materially more sensitive than simple cloud-instance management guidance and is not clearly disclosed in the description, creating a trust and secret-exposure risk if users provide long-lived API keys to the agent workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script installs mcporter globally via npm, which introduces execution of general-purpose package manager tooling and lifecycle scripts outside narrowly scoped Lighthouse management. While this may be operationally convenient, it expands the trust boundary to the npm ecosystem and allows package-install-time code execution on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script persists TENCENTCLOUD_SECRET_ID and TENCENTCLOUD_SECRET_KEY directly into a JSON config file on disk, with no permission hardening, encryption, or warning to the user. If the file is readable by other local users, backed up insecurely, or later exposed through logs or tooling, long-lived cloud credentials can be stolen and used to access or manipulate Lighthouse resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script writes configuration that causes future execution of npx -y lighthouse-mcp-server, which delegates runtime code retrieval and execution to the npm ecosystem. In this skill context, that is more dangerous because the executed package receives cloud credentials through environment variables and is intended to manage Tencent Cloud resources, increasing the blast radius of any package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script configures the MCP server to run via npx lighthouse-mcp-server without pinning a specific version or integrity source. That means future executions may fetch and run whatever package version is current at the time, creating a supply-chain risk where a compromised, typo-squatted, or maliciously updated package could execute arbitrary code with the user's privileges and access to Tencent Cloud credentials.

Content

No source excerpt is available for this finding.