Tencent Web Search API

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:21 PM UTC
• Version:
  1.0.5

Overview

This skill is a disclosed Tencent Cloud search/export tool, but users should handle API keys and output paths carefully.

Install only if you intend to use Tencent Cloud SearchPro. Use a dedicated or temporary least-privileged Tencent API key, keep config.json private, avoid confidential search queries, and choose output paths that cannot overwrite sensitive files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The document makes concrete security assurances such as endpoint restrictions, output directory validation, and secret masking without proving them in this file. If these claims are inaccurate, users may trust the skill with credentials or filesystem access under false assumptions, increasing the chance of credential exposure or unsafe execution.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The 'Known Security Features' section presents placeholder-style snippets as if they prove implemented protections. This can mislead reviewers and users into believing path traversal prevention, secret masking, and secure error handling are guaranteed even if the actual code diverges.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The policy tells users to report vulnerabilities 'privately' by opening a GitHub issue, which is typically public unless private security advisories are explicitly used. This can cause premature public disclosure, giving attackers access to exploit details before maintainers can patch.

VirusTotal

66/66 vendors flagged this skill as clean.