Security audit

Tencent Agent Storage

Security checks for vulnerabilities and agentic risk

Overview

This cloud-storage skill is mostly purpose-aligned, but it needs Review because it can expose an administrative storage token and uses broad activation plus unsafe setup instructions.

Install only if you trust the publisher and can review or patch the helper script. Use a dedicated, least-privilege Tencent storage token if possible, keep smh_basePath fixed to the legitimate Tencent endpoint, avoid the curl-to-sudo/global npm setup path, and do not allow automatic uploads unless the user explicitly names the file or directory.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:102
Finding: Privileged Remote Script Execution During Node.js Installation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:106
Finding: Unverified Archive Extracted Directly into a Privileged System Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agent-storage.js:208
Finding: Administrative Access Token Exposed in Fallback Download URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/agent-storage.js:98
Finding: Configurable API Endpoint Can Receive Administrative Credentials and Uploaded Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/agent-storage.js:68
Finding: Unnecessary Reading of General Agent Credential Stores
Content: View full analysis
{ if (!fs.existsSync(filePath)) return; const lines = fs.readFileSync(filePath, 'utf8').split('\n'); for (const line of lines) { const trimmed = line.trim(); if (!trimmed || trimmed.startsWith('#')) continue; const eqIdx = trimmed.indexOf('='); if (eqIdx === -1) continue; const key = trimmed.slice(0, eqIdx).trim(); const val = trimmed.slice(eqIdx + 1).trim().replace(/^["']|["']$/g, ''); if (!(key in envVars)) envVars[key] = val; } }; // 优先级 2：通用配置（~/.tencentAgentStorage/.env） parseDotEnv(path.join(os.homedir(), '.tencentAgentStorage', '.env')); // 优先级 3：OpenClaw（~/.openclaw/openclaw.json 的 env 字段） const cfgPath = path.join(os.homedir(), '.openclaw', 'openclaw.json'); if (fs.existsSync(cfgPath)) { try { const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf8')); const envSection = cfg.env || {}; for (const [k, v] of Object.entries(envSection)) { if (!(k in envVars)) envVars[k] = v; } } catch (e) { /* 解析失败忽略 */ } } // 优先级 4：Hermes（~/.hermes/.env） parseDotEnv(path.join(os.homedir(), '.hermes', '.env')); return { basePath: envVars['smh_basePath'] || envVars['SMH_BASE_PATH'], libraryId: envVars['smh_libraryId'] || envVars['SMH_LIBRARY_ID'], spaceId: envVars['smh_spaceId'] || envVars['SMH_SPACE_ID'], accessToken: envVars['smh_accessToken'] || envVars['SMH_ACCESS_TOKEN'], }; ``` ### Technical Analysis The implementation reads every entry from the two `.env` files into `envVars` and parses the complete OpenClaw JSON configuration, even though it only requires four SMH settings. This conflicts with the documentation's assertion that only `smh_`-prefixed environment variables ...[truncated 1172 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:119
Finding: Unpinned Third-Party SDK Installation with Global Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill’s declared purpose understates important behaviors, especially local credential/configuration access from multiple files and broader file-management capabilities like recursive directory upload and directory creation. This matters because agents and users may authorize the skill based on an incomplete trust model, leading to unintended access to local sensitive configuration and broader-than-expected data movement.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger rules are extremely broad and include common phrases like 'my files', 'search', 'find', or implicit delivery intents, which can cause the skill to activate in unrelated conversations. In context, this is dangerous because activation enables local file handling, credential loading, and external transmission to cloud storage, creating a real risk of unintended data exfiltration or privacy violations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The repeated 'MUST activate' guidance reinforces mandatory triggering without clear scope boundaries or user-confirmation gates. Because this skill can read credentials, inspect cloud contents, and upload data, ambiguous mandatory activation materially increases the chance of accidental execution and unauthorized external transmission.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 225)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 322)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 360)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 389)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 441)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 461)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 495)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 498)May include surrounding context.
md
| `upload` | `node scripts/agent-storage.js upload '<json>'` | Upload local file to cloud, returns download link |

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agent-storage.js:38