Tencent Agent Storage

• Outcome: Review
• Latest audit: Jul 24, 2026 · 5:53 AM UTC
• Version: 1.0.17

Overview

The skill has a real cloud-storage purpose, but it needs Review because it can broadly trigger uploads, read storage tokens from multiple local config locations, and includes privileged installer commands.

Install only if you intentionally want a Tencent Agent Storage integration. Provision Node.js and the SDK outside the skill, avoid letting the skill run sudo or curl-based installers, use a dedicated least-privilege storage token instead of sharing OpenClaw or Hermes configs, and require explicit confirmation of file paths before uploads or link sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill expands from cloud-drive operations into installing Node.js and npm packages, including privileged package installation paths. That grants the agent system-modification capability and introduces a supply-chain risk from downloaded installers and npm dependencies that is not strictly necessary for routine file-management behavior. In this context, the danger is increased because the skill is supposed to handle user files, yet it can bootstrap new executable tooling on the host.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill authorizes reading credentials from unrelated tool configuration locations such as ~/.openclaw/openclaw.json and ~/.hermes/.env. Even if it claims to only read smh_* keys, this broadens local secret access beyond a dedicated storage config and creates unnecessary cross-tool credential harvesting risk. The context makes this more dangerous because agents often have broad filesystem read access, so normalizing multi-source secret discovery can expose unrelated sensitive material.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script executes `npm root -g` via `execSync` to discover a globally installed SDK. Although the purpose is dependency loading, invoking a shell introduces avoidable command-execution surface and trusts environment-dependent resolution of global modules, which can be influenced on a compromised host or by a hostile PATH/npm configuration.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger rules are extremely broad and include common phrases like 'my files', 'show files', 'upload', and delivery-oriented wording that can appear in many unrelated conversations. This can cause the skill to activate unexpectedly and perform sensitive file or cloud actions without sufficiently specific user intent. In a storage skill, over-triggering is particularly risky because activation may lead to file enumeration, upload, or link sharing.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill mandates activation for ambiguous 'implicit' scenarios such as when output files need delivery or when intent merely implies another device might be involved. Those heuristics can silently route generated or local files into cloud upload flows without a precise user request. This is more dangerous in context because the skill performs external transmission and link generation, so implicit activation can become unintended data exfiltration.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill automatically reads credential material from multiple files in the user's home directory, including `.env` files and another tool's JSON config, without explicit user disclosure or consent. In an agent-skill context, silent cross-tool secret harvesting expands access beyond the immediate task and can expose tokens from unrelated applications.

External Transmission

Medium

• Category: Data Exfiltration

Content

- **NEVER** 未经用户主动要求就上传其本地个人文件
- **NEVER** 跳过执行通知："链接已生成，有效期 2 小时，可直接在浏览器或手机中打开"
- **NEVER** 在用户未明确要求覆盖时使用 `conflictStrategy: "overwrite"`
- **NEVER** 把含 `accessToken` 的中转链接（如 `https://api.tencentsmh.cn/...?access_token=...`）发给用户。返回给用户的**必须是带 COS 签名的直链**（域名为 `*.tencentsmhuc.cn`，参数含 `q-sign-algorithm` 和 `q-signature`），即脚本输出的 `downloadUrl` 字段
- **NEVER** 截断、省略或用 `...` 缩写链接。发给用户的下载链接/预览链接**必须是脚本返回的完整 URL**，一个字符都不能少。链接通常很长（含签名参数），这是正常的，**必须原样完整输出**

### Common mistakes

• Confidence: 84% confidence
• Finding: The skill is explicitly designed to transmit local files and generate externally accessible download links via Tencent endpoints. That transmission is expected for the feature, but it is still a real data-exposure boundary because signed links can be shared onward and uploads move data off-host. The risk is elevated by the skill's broad and implicit triggers, which can cause transmission in scenarios the user did not clearly authorize.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install node

# macOS (无 Homebrew)
curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

• Confidence: 97% confidence
• Finding: This instruction uses sudo to install software, giving the skill a path to privileged system modification. For a cloud-storage skill, elevating to root is unnecessary for core runtime behavior and materially increases the blast radius if the installation source or invoked commands are tampered with.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

• Confidence: 97% confidence
• Finding: The explicit 'sudo -E' preserves environment variables while executing a downloaded script as root, which can unintentionally carry sensitive or attacker-influenced environment state into privileged execution. That makes the instruction more dangerous than ordinary sudo use.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

• Confidence: 97% confidence
• Finding: The explicit 'sudo -E' preserves environment variables while executing a downloaded script as root, which can unintentionally carry sensitive or attacker-influenced environment state into privileged execution. That makes the instruction more dangerous than ordinary sudo use.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

# Windows (PowerShell, 管理员)
winget install OpenJS.NodeJS.LTS

• Confidence: 96% confidence
• Finding: Using sudo to extract a downloaded tarball into /usr/local performs privileged filesystem writes and bypasses normal package-management trust controls. In this context, a storage skill should not be modifying global runtime binaries on the host.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

• Confidence: 97% confidence
• Finding: The explicit 'sudo -E' preserves environment variables while executing a downloaded script as root, which can unintentionally carry sensitive or attacker-influenced environment state into privileged execution. That makes the instruction more dangerous than ordinary sudo use.

Credential Access

High

• Category: Privilege Escalation

Content

function loadEnvConfig() {
  const envVars = {};

  // 辅助函数：从 .env 格式文件中解析 key=value
  const parseDotEnv = (filePath) => {
    if (!fs.existsSync(filePath)) return;
    const lines = fs.readFileSync(filePath, 'utf8').split('\n');

• Confidence: 98% confidence
• Finding: This finding points to helper logic that parses credential files from disk. In this skill, that behavior is real and security-relevant because it enables automatic access to secrets stored in home-directory config files, which an invoked agent tool can use without an explicit runtime prompt.

Credential Access

High

• Category: Privilege Escalation

Content

};

  // 优先级 2：通用配置（~/.tencentAgentStorage/.env）
  parseDotEnv(path.join(os.homedir(), '.tencentAgentStorage', '.env'));

  // 优先级 3：OpenClaw（~/.openclaw/openclaw.json 的 env 字段）
  const cfgPath = path.join(os.homedir(), '.openclaw', 'openclaw.json');

• Confidence: 99% confidence
• Finding: The script explicitly reads `~/.tencentAgentStorage/.env`, which contains storage credentials. Accessing secret-bearing files is expected for functionality, but in an agent skill it is still sensitive because the skill can obtain reusable tokens without surfacing that access to the user at execution time.

Credential Access

High

• Category: Privilege Escalation

Content

if (fs.existsSync(cfgPath)) {
    try {
      const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));
      const envSection = cfg.env || {};
      for (const [k, v] of Object.entries(envSection)) {
        if (!(k in envVars)) envVars[k] = v;
      }

• Confidence: 97% confidence
• Finding: The code reads `~/.openclaw/openclaw.json` and imports values from its `env` section, effectively consuming secrets belonging to another application context. Cross-reading another tool's configuration materially increases the blast radius if this skill is triggered unexpectedly or abused.

Credential Access

High

• Category: Privilege Escalation

Content

}

  // 优先级 4：Hermes（~/.hermes/.env）
  parseDotEnv(path.join(os.homedir(), '.hermes', '.env'));
  return {
    basePath: envVars['smh_basePath'] || envVars['SMH_BASE_PATH'],
    libraryId: envVars['smh_libraryId'] || envVars['SMH_LIBRARY_ID'],

• Confidence: 99% confidence
• Finding: The script also reads `~/.hermes/.env`, another home-directory secret source. This broad secret discovery behavior is dangerous in agent environments because it expands the set of credentials the skill can automatically leverage far beyond a single declared config path.

Credential Access

High

• Category: Privilege Escalation

Content

const { libraryId, spaceId, accessToken } = smh;

  if (!libraryId) {
    throw new Error('缺少 SMH 凭证，请在 ~/.tencentAgentStorage/.env、~/.openclaw/openclaw.json 的 env 字段或 ~/.hermes/.env 中配置 smh_libraryId');
  }
  if (!spaceId || !accessToken) {
    throw new Error('缺少 SMH 凭证，请配置 smh_spaceId 和 smh_accessToken');

• Confidence: 94% confidence
• Finding: The error message itself reveals the exact credential file locations and naming conventions used by this skill and adjacent tools. While not as severe as the file reads themselves, this disclosure helps an attacker or malicious prompt author understand where valuable tokens are likely stored on disk.

Chaining Abuse

High

• Category: Tool Misuse

Content

brew install node

# macOS (无 Homebrew)
curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

• Confidence: 95% confidence
• Finding: This command chains download, privileged installation, and cleanup in one line, reducing opportunities for inspection or approval between steps. Chained execution is risky because a single invocation performs multiple sensitive actions, including root-level changes, with limited observability or control.

Chaining Abuse

High

• Category: Tool Misuse

Content

curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

• Confidence: 99% confidence
• Finding: Piping a remotely fetched script into sudo is especially dangerous because it executes unaudited network content as root without verification. The skill context does not justify this level of authority, making the pattern a real vulnerability rather than harmless documentation.

Chaining Abuse

High

• Category: Tool Misuse

Content

curl -o node.pkg "https://nodejs.org/dist/v20.18.0/node-v20.18.0.pkg" && sudo installer -pkg node.pkg -target / && rm node.pkg

# Linux (Debian/Ubuntu)
curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

• Confidence: 99% confidence
• Finding: Piping a remotely fetched script into sudo is especially dangerous because it executes unaudited network content as root without verification. The skill context does not justify this level of authority, making the pattern a real vulnerability rather than harmless documentation.

Chaining Abuse

High

• Category: Tool Misuse

Content

curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs

# Linux (其他发行版 / 通用)
curl -fsSL https://nodejs.org/dist/v20.18.0/node-v20.18.0-linux-x64.tar.xz | sudo tar -xJ -C /usr/local --strip-components=1

# Windows (PowerShell, 管理员)
winget install OpenJS.NodeJS.LTS

• Confidence: 96% confidence
• Finding: Piping a downloaded archive directly into sudo tar performs privileged extraction of network content without validation or intermediate review. That can overwrite files in privileged locations and install compromised binaries if the source is malicious or intercepted.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/agent-storage.js:38