Security audit

Tencent Cloud Rum

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Tencent Cloud RUM analysis, but its setup stores reusable cloud credentials in plaintext and globally installs a package automatically.

Install only with a dedicated least-privilege Tencent Cloud key limited to required RUM/APM read access. Treat the configured SecretId and SecretKey as reusable cloud account secrets, avoid committing or sharing the mcporter config, restrict $HOME/.mcporter permissions, and rotate the keys if the file may have been exposed. Review the global npm install step before running setup.sh.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: setup.sh:49
Finding: Persistent storage of cloud API credentials without explicit permission hardening
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:10
Finding: Automatic global installation of an externally retrieved npm package
Content: View full analysis
/dev/null; then echo "⚠️ mcporter not found, installing v${MCPORTER_VERSION}..." npm install -g "mcporter@${MCPORTER_VERSION}" echo "✅ mcporter v${MCPORTER_VERSION} installed" fi ``` ### Technical Analysis When `mcporter` is absent, the setup script automatically retrieves and globally installs `mcporter@0.9.0` from the user's active npm registry. Pinning the version reduces unplanned version drift, but the script does not verify an integrity digest, package signature, provenance attestation, or expected registry. npm installation may execute package lifecycle scripts. Therefore, code contained in the retrieved package or its dependency graph can execute with the privileges of the user running `setup.sh`. A global installation also modifies user-wide or system-wide npm locations rather than limiting changes to the Skill's project directory. The repository does not contain evidence that `mcporter@0.9.0` is malicious. The confirmed issue is that setup creates an unnecessary and insufficiently verified supply-chain execution path. ### Attack Path 1. A user runs `bash setup.sh` on a system where `mcporter` is not installed. 2. The script invokes `npm install -g "mcporter@0.9.0"` without confirmation. 3. npm resolves the package and transitive dependencies through the currently configured registry. 4. If the registry, package publication account, package artifact, or dependency graph has been compromised, attacker-controlled package content is downloaded. 5. npm lifecycle scripts or installed executable code run with the privileges of the invoking user. 6. The malicious package may read accessible files and environment variables, alter user-level configuration, o ...[truncated 1054 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs users to provide long-lived Tencent Cloud SecretId and SecretKey credentials, including placing them in MCP headers, without a prominent warning that these are highly sensitive account secrets. This increases the risk of accidental exposure through logs, screenshots, copied configs, chat transcripts, or reuse in insecure environments, potentially enabling unauthorized access to RUM data or broader Tencent Cloud resources depending on IAM scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document includes a concrete example for querying logs of a specific user via a unique identifier (uin) without any privacy guardrails, approval requirements, or data-minimization guidance. In a monitoring skill, this can normalize targeted retrieval of user activity and expose sensitive behavioral or debugging data beyond what is necessary for aggregate performance analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill documentation instructs users to supply long-lived SecretId and SecretKey headers but provides no warning about secure handling, storage, logging, or least-privilege scoping of those secrets. In an agent/tooling context, this increases the risk that operators paste sensitive cloud credentials into configs, prompts, repos, or logs, which could enable unauthorized access to Tencent Cloud telemetry or broader account resources if overprivileged keys are used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script persists Tencent Cloud SecretId and SecretKey to $HOME/.mcporter/mcporter.json in plaintext, creating a durable local copy of long-lived credentials. Any local user, malware, backup system, or tool that can read the home directory may recover these secrets, and the script provides no warning, permission tightening, or safer alternative despite handling cloud API credentials.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a skill for querying and analyzing Tencent Cloud RUM data, but this file additionally instructs users to provision and pass raw Tencent Cloud API credentials in HTTP headers. While authentication may be necessary for backend connectivity, exposing credential-handling instructions in the skill docs is a separate capability not justified by the user-facing analysis purpose itself.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.