腾讯文档链接解析归档

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:21 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Tencent Docs archiving workflow that writes local copies and an Excel ledger, with some implementation hygiene issues but no evidence of hidden or malicious behavior.

Install this only if you want an agent to download Tencent Docs links you provide and store copies plus a ledger on your Desktop. Review the extracted link list before allowing downloads, avoid opening ledger entries from untrusted inputs, and install openpyxl from a trusted Python environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update_ledger.py:48

Finding

Excel Formula Injection Through Unvalidated Ledger Fields

Content

View full analysis

Vulnerability Details

File Location: scripts/update_ledger.py, lines 48–58
Vulnerability Type: Spreadsheet formula injection
Risk Level: Medium

python

        else:
            ws.append([date, url])
            added += 1
    wb.save(ledger_path)
    return added


def main():
    parser = argparse.ArgumentParser(description="更新腾讯文档归档台账")
    parser.add_argument("--date", default=datetime.now().strftime("%Y%m%d"), help="下载日期 YYYYMMDD")
    parser.add_argument("--url", action="append", required=True, help="腾讯文档链接（可多次指定）")

Technical Analysis

The --date and --url arguments are accepted as arbitrary strings and written directly to cells in an XLSX workbook. The script does not enforce the documented YYYYMMDD date format, validate that URLs use the expected docs.qq.com host, or neutralize spreadsheet formula prefixes.

Spreadsheet applications can interpret cell values beginning with characters such as =, +, -, or @ as formulas rather than plain text. Consequently, an attacker who controls either command-line value can inject a formula into the generated ledger. Depending on the spreadsheet application and its security configuration, formulas may create deceptive hyperlinks, initiate external network requests, expose spreadsheet data, or invoke dangerous legacy functionality.

Attack Path

1. An attacker supplies a crafted value to a system or operator that ultimately invokes update_ledger.py.
2. The script is run with a formula-like value, for example through --date '=HYPERLINK("https://attacker.example","Open document")' or an equivalently crafted --url value.
3. argparse accepts the value because no format or hostname validation is configured.
4. ws.append([date, url]) stores the attacker-controlled input in the workbook.
5. A user opens 腾讯文档链接台账.xlsx in spreadsheet software.
6. The spreadsheet application interprets the cell as a formula. The resulting ...[truncated 621 chars]

Remediation

View remediation

Remediation Suggestions

1. Validate --date using datetime.strptime(value, "%Y%m%d") and reject any value that does not exactly match the required format.
2. Parse every URL with a standard URL parser and require an approved scheme, preferably HTTPS.
3. Require the normalized hostname to be exactly docs.qq.com, or explicitly document and enforce a narrowly defined subdomain policy.
4. Reject URLs containing unexpected credentials, control characters, or malformed components.
5. Before writing user-controlled text to a spreadsheet, treat it explicitly as text. Reject or prefix values beginning with =, +, -, or @ with an apostrophe.
6. Apply validation within append_rows as well as at the CLI boundary so that future programmatic callers cannot bypass it.
7. Add tests covering formula prefixes, malformed dates, alternate hosts, deceptive hostnames, and encoded control characters.

T08 · Insecure Dependencies

Note

• Location: scripts/update_ledger.py:13

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: scripts/update_ledger.py, lines 13–16
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

python

try:
    import openpyxl
except ImportError:
    print("ERROR: openpyxl not installed. Run: pip install openpyxl", file=sys.stderr)
    sys.exit(1)

Technical Analysis

When openpyxl is unavailable, the script instructs the user to execute pip install openpyxl. This command does not specify a reviewed version, verify package hashes, use a lockfile, or identify a trusted package index. It therefore resolves mutable dependency content according to the user's current Python and package-index configuration.

This is not evidence that openpyxl itself is malicious. The weakness is that installation is non-reproducible and relies on the integrity of the configured package source and whichever package version is current at installation time.

Attack Path

1. A user runs the script in an environment where openpyxl is not installed.
2. The script prints the unconstrained installation command.
3. The user follows the instruction and runs pip install openpyxl.
4. pip resolves the package and its dependencies through the environment's configured index or mirror without project-supplied version or hash constraints.
5. If that source, configuration, resolved release, or transitive dependency is compromised, malicious package code may execute during installation or later import.

Impact Assessment

The exact impact depends on the integrity of the package source and the privileges used to run pip. A compromised dependency could execute code with the installing user's privileges, access that user's files and environment variables, modify the Python environment, or affect later script executions. Installing with elevated privileges would increase the potential scope. Under normal use with a trustworthy package index and uncompromised package ...[truncated 67 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare openpyxl in a project dependency file rather than recommending an ad hoc installation command.
2. Pin a reviewed version or use a lockfile that records the complete dependency graph.
3. Use package hashes, such as pip's --require-hashes workflow, to verify downloaded artifacts.
4. Install dependencies from an explicitly trusted package index or controlled internal mirror.
5. Perform installation in an isolated virtual environment with ordinary user privileges.
6. Establish a dependency-review and update process so pinned versions receive deliberate security updates.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose describes an end-to-end Tencent Docs archival workflow: detect docs.qq.com links in user-provided text, extract them, download/export documents, store them in a Desktop folder, and update a ledger. The supplied code performs only the last step: updating an Excel ledger with provided URLs and a date. It does create/use the Desktop/腾讯文档 directory and ledger workbook, which partially aligns with the bookkeeping portion of the description, but the primary advertised capabilities—link parsing, domain restriction handling, downloading/exporting, and file archival—are absent. This is a material under-implementation of the declared behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs automatic local filesystem changes—creating directories, saving downloaded files, and modifying an Excel ledger—without requiring explicit user confirmation before those side effects occur. In an agent setting, this can cause unintended writes to the user's machine, potentially storing sensitive documents locally or altering files based on a pasted message containing links. The context makes this more dangerous because the skill is designed to trigger on user text and perform bulk actions automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The module docstring, CLI description, and help text are presented only in Chinese, which can amount to forcing a specific language without user opt-in under the stated policy. There is no indication that the tool is region-specific or that alternate language support is intentionally limited and documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code creates a directory on the user's Desktop and targets an Excel file for persistent updates, which is a file-write operation covered by the warning requirement for code files. Although the script prints a status message after updating, there is no advance disclosure in the docstring or comments that running it will create or modify files under Desktop/腾讯文档.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script creates a new workbook when the ledger does not exist and later appends records before saving, which changes user data on disk. The current user-facing output occurs only after completion, so the code lacks a visible warning or explanatory comment before the write takes place.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.