Security audit

腾讯频道Skill

Security checks for vulnerabilities and agentic risk

Overview

This Tencent channel management skill is mostly purpose-aligned, but it asks agents to install and trust a mutable global CLI and to run command strings returned at runtime while managing public posts, members, DMs, and notifications.

Install only if you trust the Tencent channel CLI source and are comfortable granting it access to your QQ/Tencent channel account. Before use, prefer a pinned and verified CLI install, do not execute returned command strings blindly, require explicit confirmation before deletes, mutes, kicks, approvals, DMs, or public posts, and avoid automatic URL fetching unless the URL is clearly safe.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:59
Finding: Unpinned Global Installation of a Privileged CLI Dependency
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 59-65
Vulnerability Type: Supply-chain exposure through an unpinned global npm dependency
Risk Level: High

Vulnerable Code Snippet:

bash
tencent-channel-cli version # If it is not installed or its version is below 1.0.6: npm install -g tencent-channel-cli

The instructions further require upgrading with the same unpinned command before continuing:

bash
npm install -g tencent-channel-cli

Technical Analysis

The Skill mandates installation of tencent-channel-cli from npm by package name without specifying an exact version, package integrity hash, trusted registry URL, lockfile, or cryptographic signature. Consequently, the package resolved at execution time can differ from the package that existed when the Skill was audited.

Global npm installation may also execute package lifecycle scripts such as preinstall, install, and postinstall. These scripts run with the privileges of the user operating the Agent. The installed CLI subsequently handles authentication, channel administration, content moderation, private messages, and notification subscriptions, making a compromised package especially sensitive.

Merely enforcing a minimum version does not prevent installation of a later compromised release.

Attack Path

An attacker compromises the npm publisher account, package registry path, release pipeline, or a future package version.

The user invokes the Skill on a system where the CLI is absent or below the required minimum version.

The Agent executes npm install -g tencent-channel-cli.

npm resolves the current mutable release and executes any associated lifecycle scripts.

The malicious package gains code execution with the Agent user's privileges.

The compromised CLI can subsequently intercept credentials and alter administrative operations presented as legitimate Tencent Channel commands.

...[truncated 730 chars]
Remediation: View remediation
Remediation Suggestions

Pin the CLI to an exact audited version, for example:
bash
npm install -g --ignore-scripts tencent-channel-cli@1.0.6

Specify the expected official npm registry explicitly and reject unexpected registry configuration.

Verify a publisher-provided cryptographic signature or SHA-256 integrity value before installation.

Disable npm lifecycle scripts with --ignore-scripts unless an audited installation step strictly requires them.

Prefer a project-local, lockfile-controlled dependency or a verified standalone binary over global installation.

Run the CLI in a restricted environment with minimum filesystem and network permissions.

Maintain an allowlist of approved versions and require a separate review before changing that allowlist.

Do not automatically install or upgrade the dependency merely because a remote version header indicates a newer release.

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:185
Finding: Execution of Runtime Command Strings Returned by the CLI or Backend
Content: View full analysis
Vulnerability Details

File Locations: SKILL.md, lines 185-202; references/notification-reference.md, lines 32-41
Vulnerability Type: Dynamic command execution without command allowlisting or argument validation
Risk Level: Critical

Vulnerable Instruction Snippets:

The quick-command protocol requires execution of a returned resume_command:

json
{ "data": { "status": "waiting", "id": "s-abc12345", "step": "1/5", "pending": { "type": "pick", "hint": "Select the channel where the post should be published", "options": [], "resume_command": "tencent-channel-cli feed quick-publish --resume-id s-abc12345 --pick <INDEX> --json" } } }

The operative instruction states that when the status is waiting, the Agent must continue by executing the returned resume_command. It also instructs the Agent to execute command strings from notification hint objects:

json
{ "setup_hint": { "action": "subscribe_notices", "command": "tencent-channel-cli manage notices-on", "message": "Login succeeded. Channel notifications can now be enabled." } }

Similar behavior is required for subscribe_hint.command.

Technical Analysis

The Skill treats command strings returned at runtime as authoritative executable instructions. It does not require the Agent to parse the response into a typed data structure, verify the executable path, validate the subcommand against an allowlist, reject shell metacharacters, or reconstruct the command from trusted constants.

Runtime responses may originate from the installed CLI, remote service responses processed by that CLI, or mutable local state. If any of these sources are compromised, an attacker can replace a legitimate command with a string containing shell operators, command substitution, redirection, or an unexpected executable.

User consent to enable notifications ...[truncated 1814 chars]
Remediation: View remediation
Remediation Suggestions

Never execute command or resume_command strings returned by a CLI, backend, or local state file.

Accept only typed response fields such as a resume identifier, option index, and enumerated action.

Reconstruct the command locally from trusted constants. For example, invoke a fixed executable with an argument array rather than a shell command string.

Restrict executable paths to a verified absolute path for tencent-channel-cli.

Allowlist exact domain/action pairs, including only expected notification and resume operations.

Validate identifiers and indexes with strict regular expressions and numeric bounds.

Reject shell metacharacters, redirection tokens, command substitutions, newlines, and unexpected flags.

Use a process-spawning API with shell disabled.

Validate hint actions independently. For example, map the enumerated action subscribe_notices to a locally defined command rather than trusting hint.command.

Require explicit user confirmation again if the reconstructed operation has effects beyond the action originally authorized.

T09 · Insecure Skill Coding Practices

Error

Location: references/feed-reference.md:176
Finding: Unrestricted Fetching of User-Supplied URLs Enables SSRF
Content: View full analysis
Vulnerability Details

File Location: references/feed-reference.md, lines 176-177
Vulnerability Type: Server-side request forgery through unrestricted WebFetch requests
Risk Level: High

Vulnerable Instruction Snippet:

text
If the user provides only a URL without display text, use WebFetch to retrieve the page's HTML title and use it as the link text. If retrieval fails, use the URL itself as the fallback. If the user's message or supplied content contains a bare URL, identify it, ask whether it should be converted into a clickable link, and, after confirmation, use WebFetch to retrieve the page title.

Technical Analysis

The Skill instructs the Agent to fetch arbitrary URLs supplied in user content. It does not define any URL scheme allowlist, hostname validation, DNS resolution checks, redirect validation, port restrictions, response-size limits, or prohibitions on loopback, private-network, link-local, reserved, and cloud metadata addresses.

An attacker can therefore provide a URL that directly targets an internal service or initially resolves to a public address and then redirects or changes DNS resolution to an internal address. Because WebFetch operates from the Agent's environment, the request may reach resources unavailable from the attacker's own network.

Fetching only an HTML title does not prevent SSRF: the outbound request occurs before the title is parsed. Moreover, returned page content remains untrusted and could contain text designed to manipulate later Agent processing.

Attack Path

An attacker supplies a bare URL in content intended for publication or asks the Agent to make the URL clickable.

The Agent follows the Skill instructions and sends the URL to WebFetch to obtain a title.

The URL resolves or redirects to a loopback address, private service, link-local endpoint, or cloud instance metadata service.

The Agent's network environment performs the r ...[truncated 982 chars]
Remediation: View remediation
Remediation Suggestions

Permit only https and, where strictly necessary, http URLs.

Reject URLs containing credentials, ambiguous encodings, unsupported schemes, or nonstandard destination ports.

Resolve the hostname before each request and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges for both IPv4 and IPv6.

Repeat destination validation after every redirect and limit the number of redirects.

Protect against DNS rebinding by binding the validated resolution to the actual connection destination.

Maintain an explicit denylist for known metadata endpoints, including link-local metadata addresses.

Apply strict connection, read, and total timeouts, along with a small response-size limit.

Parse only the minimum HTML required for the title and treat all returned content as untrusted data rather than Agent instructions.

Consider avoiding remote retrieval entirely by using the hostname or user-provided display text as the link label.

Log blocked requests without recording sensitive query strings or credentials.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The markdown instructs the skill to explain fields using Chinese business semantics and specific Chinese names, which imposes a locale/language preference. There is no opt-in or alternative language path for users who may prefer another language.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.
md
当匹配下列意图时，优先使用快捷命令。一次调用替代多次 tool_call，提高处理速度。 | 意图 | 命令 | | ------------ | ----------------------------------------------------------------------------------------------------- | | 搜索频道并加入 | `tencent-channel-cli manage search-and-join --keyword "<关键词>" --json` | | 在频道内发帖 | `tencent-channel-cli feed quick-publish --content "<内容>" --json`（含 Markdown 语法时改用 `--markdown-content`） |

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation directs the agent to use WebFetch to retrieve titles from arbitrary user-provided URLs, which expands the skill beyond Tencent channel operations into external network access. That creates SSRF-style and data-exfiltration risk if an attacker supplies internal, cloud-metadata, or otherwise sensitive URLs, and it also introduces unbounded interaction with untrusted remote content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow explicitly recommends autonomous moderation where AI judges content and then deletes posts, but the warning only notes 'high risk, need confirmation' at the command step and not as a firm policy boundary for automation. In practice, this can enable destructive actions at scale from imperfect model judgments, causing wrongful deletion, censorship, or abuse if prompts or content are adversarially crafted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing skill instructions exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document instructs the agent to map short, ambiguous utterances like “同意”, “拒绝”, “评论”, or “回复” to state-changing commands based on the most recent notification context. This can cause unintended actions if the agent misidentifies the relevant notification or interprets casual conversation as an operational command, especially because the user is told they need not reference the specific message.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This section documents commands that modify remote state—approving/refusing requests and sending DM replies—without a consistent, explicit warning that these actions have external effects and may be irreversible or user-visible. In an agent setting, that increases the risk of silent or accidental execution of impactful actions on behalf of the user.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The automatic reply workflow authorizes scanning posts, generating responses, and publishing comments on users' behalf without a strong consent and disclosure boundary. That can lead to unauthorized speech, spam, reputational harm, and prompt-injection-driven posting behavior, especially because the skill is designed for community interaction and the model is deciding both what to say and when to post it.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: 全文以中文固定描述用户意图和触发词，并在多处用“用户说‘同意’‘拒绝’‘评论他’等”作为必须遵守的处理规则，但没有说明是否支持其他语言或允许用户选择语言。这可能构成语言/locale 强制约束，尤其当技能面向更广泛用户群时。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T01 · Skill Instruction Hijacking

Vulnerability Details

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Natural-Language Policy Violations

Whitespace Padding

Context-Inappropriate Capability

Missing User Warnings

Natural-Language Policy Violations

Vague Triggers

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Static analysis