QQ-Bot-connect

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

This QQ messaging skill is purpose-aligned but needs Review because it can send user content externally and includes a concrete recipient ID without clear confirmation safeguards.

Review this skill before installing. Only use it if you are comfortable with an agent sending messages and files to QQ recipients, replace the placeholder config with your own validated recipient IDs, and require the agent to show the resolved recipient and content before every send.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

Hardcoded QQ Recipient Identifier May Cause Unintended Message Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29 and 72
Vulnerability Type: Hardcoded recipient identifier and unsafe example configuration
Risk Level: Medium

Vulnerable Code

At SKILL.md:29, the documented target format contains a concrete recipient identifier:

text

qqbot:c2c:4AFDDAB3E1ABB0B75D790C12B22086EF

At SKILL.md:72, the example configuration repeats the same identifier:

json

{
  "_readme": "QQ-bot-connect configuration file",
  "default": {
    "openid": "4AFDDAB3E1ABB0B75D790C12B22086EF",
    "type": "c2c",
    "name": "Owner"
  },
  "_format": {
    "c2c_private": "qqbot:c2c:{openid}",
    "group": "qqbot:group:{groupid}"
  }
}

Technical Analysis

The skill embeds an actual-looking QQ openid in operational examples. This conflicts with the packaged config.json, where default.openid is an explicit placeholder. Because language-model agents frequently derive tool arguments directly from examples, the concrete identifier may be treated as a usable default rather than illustrative data.

When the skill is invoked to send text or local media, the agent could copy the example target instead of resolving and validating the recipient from config.json or the user's request. This is particularly significant because the skill supports files, images, audio, and video in addition to text.

The identifier is not established to be a credential or secret. The security issue is unsafe recipient selection that can disclose user-provided content to an unintended QQ account.

Attack Path

1. The skill is loaded in response to a request to send text or a local file through QQ.
2. The agent reads the concrete qqbot:c2c:4AFDDAB3E1ABB0B75D790C12B22086EF example.
3. The packaged configuration provides no valid default identifier because its value is only a placeholder.
4. Instead of rejecting the missing configuration or asking the user to confirm a recipient, the agent adopts the concrete example identifi ...[truncated 785 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every concrete QQ identifier in the documentation with an unmistakable placeholder:

text

qqbot:c2c:{OPENID}

2. Update the example configuration accordingly:

json

{
  "default": {
    "openid": "{OPENID}",
    "type": "c2c",
    "name": "{DISPLAY_NAME}"
  }
}

3. Require the agent to reject empty, placeholder, or malformed identifiers rather than falling back to documentation examples.

4. Resolve recipients only from an explicitly supplied user target or a validated local configuration value.

5. Before sending, present the resolved recipient type and identifier to the user for confirmation, especially when transmitting files or other potentially sensitive media.

6. Add an explicit rule stating that identifiers appearing in documentation are examples and must never be used as live recipients.

7. Consider maintaining an allowlist of approved recipients and requiring additional confirmation when a requested target is not on that list.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad enough that ordinary conversation about QQ or sending messages could unintentionally invoke this skill. Because the skill performs proactive outbound messaging, accidental invocation can lead to unintended message delivery, privacy leakage, or social-engineering amplification without a sufficiently explicit user action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables sending messages, files, and media to QQ users or groups, but the description does not warn about privacy, misdelivery, or the consequences of sending content externally. In this context, missing warnings increase the chance that users or the agent will transmit sensitive data, spam recipients, or send to the wrong target without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The _how_to_use field gives direct operational guidance to read default.openid and send to qqbot:c2c:{openid} without defining any authorization, confirmation, or trigger constraints. In a skill that can proactively message QQ users, this broad instruction can enable unintended or silent outbound messaging to a preset recipient.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The configuration explicitly instructs use of a configured default recipient (default.openid) for sending messages, but provides no warning, consent notice, or visibility to the end user. Because this skill is designed for proactive QQ message delivery, a hidden default destination increases the risk of privacy leaks, misdelivery, or covert exfiltration of user content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

All user-facing natural-language strings in this file are written in Chinese, including usage guidance and labels, with no indication that other languages are supported or that the user can opt in to this locale. This can violate a language/locale policy where skills should not force a specific language without user choice unless the regional constraint is explicitly documented.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.