AndonQ

• Outcome: Pass
• Latest audit: Aug 12, 2026 · 6:43 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed Tencent Cloud support assistant that uses user-provided Tencent credentials to read ticket data and send SmartQA questions to Tencent Cloud, with no artifact-backed evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable giving the skill access to Tencent Cloud support-ticket data available to your AK/SK. Use a least-privilege subaccount key, avoid saving long-lived secrets in shell profiles, avoid verbose/dry-run output in shared logs, and explicitly state whether you want personal or organization-wide ticket data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes capabilities that can read environment variables, access files, invoke shell commands, and make network requests, yet it declares no explicit permissions or guardrails. In this context, that is dangerous because the skill handles cloud credentials and sensitive ticket data; without declared permissions, a host agent may expose more capability than users expect, weakening consent and policy enforcement.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The ticket-list trigger phrases include broad everyday language such as '看看工单' and '有哪些工单', which can cause accidental invocation from loosely related conversation. In this skill, unintended activation can lead to retrieval and display of potentially sensitive ticket metadata, including issue titles and status information, even when the user did not intend to query backend data.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The ticket-detail triggers are ambiguous, including phrases like '查看工单' and '工单状态', which may match general support conversation without a clear ticket identifier. If auto-routed, the skill may fetch and expose detailed ticket contents and comments, increasing the chance of unintended disclosure of support history and sensitive operational details.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The group ticket-detail action reuses overlapping phrases like '工单详情', which conflicts with the personal ticket-detail action and lacks clear disambiguation of data scope. In this skill, that ambiguity is more dangerous because the group endpoints can expose organization-wide ticket information, including other members' records, so a misfire can broaden disclosure beyond the current user's own tickets.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The human-support trigger list includes the broad phrase '我要找人', which can easily appear in unrelated conversation and accidentally redirect the interaction. While this is less severe than data-fetching misroutes, it can still disrupt workflows, bypass intended triage, and potentially send users to an external support endpoint unexpectedly.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger phrases are broad enough to activate the skill for generic requests like 'story list' or 'member stories' without clearly constraining that the user is asking about Tencent Cloud organization demand tickets. In a support skill that can query organization-level records, overbroad activation increases the risk of misrouting, unintended data retrieval, or exposing ticket metadata when the user intent is ambiguous.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to display ticket operation history including `InnerReply`, `Remark`, operator identity, and a `HasSecret` flag, but it does not require masking, withholding, or access-checking sensitive/internal content before presentation. In a ticketing context, operation logs commonly contain internal notes, support workflow details, or secrets; merely noting that `HasSecret=1` indicates sensitive content is insufficient because the dangerous disclosure may already have occurred.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases are broad enough to match generic support requests and may invoke this skill outside the user's intended scope. In this context, misrouting matters because the skill can retrieve ticket details and comments, potentially exposing support history or internal case data when a user only asked a general question.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation exposes an option to return signed COS attachment URLs without warning that these links may grant direct access to attached files. In a ticketing context, attachments can contain logs, screenshots, credentials, personal data, or internal infrastructure details, so surfacing signed URLs without user-facing caution increases the risk of unintended data disclosure.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are broad enough to activate on generic requests like '查询工单' or '看看工单' without any built-in confirmation or disambiguation step. In a skill that surfaces support-ticket data, this can cause unintended invocation and disclosure of potentially sensitive ticket metadata or contents to a user who did not explicitly intend to access this function.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document instructs the agent to display ticket lists and problem descriptions but does not warn that ticket titles, descriptions, and status details may contain sensitive operational or account information. Because this skill is specifically designed to retrieve support tickets, the context makes accidental exposure more concerning than in a generic informational skill.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes sending user questions to the Andon/Tencent Cloud smart customer-service backend but does not clearly warn users that their prompts are transmitted to an external service. This can lead users to disclose sensitive account, operational, or business information under the assumption the interaction is local or internal-only, creating a privacy and data-handling risk.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: Verbose and dry-run modes print the full user question and the encoded payload to stdout, which can expose sensitive prompts, account details, ticket contents, or internal support data through terminal history, logs, screen recording, or shared CI output. Although this is a diagnostic feature rather than overtly malicious behavior, base64 encoding is not protection and the code provides no masking, warning, or opt-in redaction for potentially sensitive fields.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

log_section("3. 检查 AK/SK 配置")
    cred_ok, cred_msg = check_credentials()
    if cred_ok:
        secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID", "")
        secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY", "")
        log_ok(f"TENCENTCLOUD_SECRET_ID: {mask_credential(secret_id)}")
        log_ok(f"TENCENTCLOUD_SECRET_KEY: {mask_credential(secret_key)}")

• Confidence: 83% confidence
• Finding: The script reads cloud credentials from environment variables and then prints masked forms to stdout. Even though masking hides most characters, exposing the presence and suffix of secrets can aid correlation, leak partial secret material into logs, and unnecessarily handle highly sensitive values in a script whose purpose is only environment validation.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

cred_ok, cred_msg = check_credentials()
    if cred_ok:
        secret_id = os.environ.get("TENCENTCLOUD_SECRET_ID", "")
        secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY", "")
        log_ok(f"TENCENTCLOUD_SECRET_ID: {mask_credential(secret_id)}")
        log_ok(f"TENCENTCLOUD_SECRET_KEY: {mask_credential(secret_key)}")
    else:

• Confidence: 83% confidence
• Finding: The secret key is fetched from the environment and partially disclosed in logs. Partial disclosure of secret keys is still sensitive, especially in shared terminals, CI logs, or support transcripts, and increases the blast radius if logs are retained or exposed.

Static analysis

No suspicious patterns detected.