腾讯出行服务跑腿 Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:00 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its courier-booking purpose, but it handles tokens, precise addresses, cancellations, and payment links in ways that need careful review before installation.

Review this skill before installing. Use it only if you are comfortable giving it a Tencent delivery token and storing delivery names, phone numbers, addresses, and coordinates locally. Verify payment links in WeChat/Tencent directly, avoid use on shared machines, and delete the token/session/address-book data when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Error

• Location: scripts/tms_delivery.py:458

Finding

Payment URI Disclosed to an Unrelated Third-Party QR Service

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tms_delivery.py:77

Finding

Access Token Stored in Plaintext Without Enforced Owner-Only Permissions

Content

View full analysis

"), ``` ### Technical Analysis The access token is written in plaintext to `~/.config/tms-delivery/env.json`. The code calls `os.makedirs()` and `open()` without explicitly setting restrictive modes such as `0700` for the directory and `0600` for the file. The resulting permissions therefore depend on the process umask and any pre-existing directory or file permissions. If the file already exists with permissive permissions, rewriting it does not correct those permissions. The token is also passed as a command-line argument. Depending on the execution environment, command-line arguments may be visible through process inspection, Agent tool logs, shell history, audit records, crash reports, or observability platforms. ### Attack Path 1. The user provides an MCP access token. 2. The Agent invokes `tms_delivery.py save-token `. 3. The token becomes part of the process argument vector and may be recorded by the execution environment. 4. `_save_config()` writes the token in plaintext to `env.json`. 5. No code enforces owner-only permissions on the directory or file. 6. A local account, diagnostic collector, backup p ...[truncated 790 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tms_delivery.py:636

Finding

Delivery Contact and Precise Location Data Persisted Without Enforced File Protection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

python3 ./scripts/tms_delivery.py bootstrap

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

python3 ./scripts/tms_delivery.py bootstrap

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md

python3 ./scripts/tms_delivery.py bootstrap

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The estimate request sends sender/receiver names, phone numbers, and address/location coordinates to https://weixin.go.qq.com, which is a privacy-sensitive network transmission. While this is part of the skill's purpose, the code file lacks any explicit disclosure to the user that their contact and location data will be sent to an external service for quoting/order placement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to execute local Python scripts, access session state, use MCP-backed network actions, and handle tokens, but it declares no explicit tool scope or permissions boundary. That creates an overbroad-capability risk: an orchestrator may expose more filesystem, environment, or network access than intended, making prompt-injected or malformed flows more dangerous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill title and operational description are presented entirely in Chinese, and the trigger guidance in the description is also Chinese-specific. This indicates the skill is effectively constrained to a specific language/locale, but the file does not offer the user a language choice or explicitly justify the restriction as a region-specific policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The entire API contract and user-facing guidance are written as mandatory Chinese instructions, including quoted messages to display to users, with no indication that another language may be used or that the user can opt in to Chinese. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The natural-language instructions and user-facing responses in this file are exclusively Chinese, and there is no indication that the user can choose another language or opt in to this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file includes an invocation example, 「帮我从公司寄个文件到XX」, but does not define a constrained trigger set or exclusion conditions. Because the workflow file lacks negative examples or scope boundaries, the activation guidance is somewhat ambiguous and could match ordinary conversational requests beyond the intended skill context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file contains all operational instructions, triggers, and user-facing guidance exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation expands the skill's behavior beyond Tencent Mobility delivery by directing payment-link handling through an external QR service. In a payment context, this broadens the trust boundary and can leak order/payment metadata or expose users to tampering, tracking, or service substitution risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The referenced external endpoint indicates direct transmission of payment-related URL data to api.qrserver.com. In this skill context, the external transmission occurs during checkout and is more dangerous because users are being guided to complete payment, making confidentiality, integrity, and trust-boundary violations materially significant.

Content

Scanner excerpt · references/delivery/step-6-payment.md (reported line 10)May include surrounding context.

md

`book-order` 返回值已包含 `reply_template` 字段，**原样贴给用户即可**。

`reply_template` 内部已：
- 使用 `payInfo.codeUrl`（首选，weixin:// 协议）通过 `https://api.qrserver.com/v1/create-qr-code/` 编码为二维码图片
- `codeUrl` 为空时兜底使用 `payInfo.scanUrl`
- 图片下方附带 `scanUrl` 纯文本兜底链接
- 已包含订单号 / 寄收地址 / 费用 / 支付完成提示

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to render payment data through a third-party QR generation service unrelated to the stated Tencent delivery capability. This causes payment URLs or deep links to be transmitted to an external domain, creating unnecessary data exposure and dependency on an untrusted service during a payment step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The markdown explicitly sends payment QR/link content to a third-party QR code service without warning the user that payment data will be transmitted externally. Because the content includes payment entry points and may be associated with order details shown in the same template, this creates a privacy and phishing-surface issue at a sensitive transaction step.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition includes very broad acknowledgements such as “OK” and “好了”, which are common conversational replies that may appear outside an actual payment-confirmation context. In a delivery skill tied to order-state transitions and address-book prompts, this can cause unintended activation of the post-payment flow, leading to confusing order handling, unnecessary backend queries, or follow-on actions based on ambiguous user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document is entirely written in Chinese and prescribes fixed Chinese user-facing reply text such as prompts and warning messages. There is no indication that users may choose another language or that the locale restriction is optional or region-justified, which creates a language/locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The cancellation flow treats many generic acknowledgements such as “好”, “嗯”, “是”, and “确认” as authorization to execute a destructive action. In a conversational interface, these replies are easily elicited by ambiguous prompts or can refer to understanding rather than consent, creating a real risk of unintended order cancellation and associated cancellation fees or service disruption.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill enforces a Chinese-only token acquisition reply template and explicitly forbids any additional content, which can prevent the agent from communicating critical setup and consent information in the user's language. In a delivery skill that handles authentication tokens and order actions, this raises the risk of user confusion, mistaken credential handling, and inaccessible operation for non-Chinese readers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document explicitly describes persisting sensitive delivery data in a local session file, including sender/receiver names, phone numbers, and address/location details. Although it says not to leak data to the user and to avoid direct file access, it does not mention encryption, retention limits, access controls, or explicit user notice/consent, so local privacy exposure remains if the host is shared, compromised, or logs/backups capture the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script stores the Tencent access token in plaintext under ~/.config/tms-delivery/env.json without any file-permission hardening, encryption, or user consent flow in this file. A local attacker or another process running as the same user could recover the token and make authenticated MCP requests as the user.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The mcp-call command exposes a generic pass-through interface to any MCP tool name and arbitrary JSON arguments, while the skill is supposed to be limited to same-city courier workflows. If the surrounding agent can invoke this script, an attacker could coerce the agent into calling unintended Tencent MCP capabilities using the stored access token, bypassing workflow guardrails implemented elsewhere in the file.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The payment template sends codeUrl data to https://api.qrserver.com/ to render a QR image. That leaks payment-related URL contents to an unrelated third-party service, potentially exposing payment session metadata or links that should remain only between the user and Tencent/WeChat.

Content

Scanner excerpt · scripts/tms_delivery.py (reported line 478)May include surrounding context.

python

if code_url:
        # weixin:// 协议必须 URL 编码后再拼到 qrserver 的 data 参数
        qr_src = (
            "https://api.qrserver.com/v1/create-qr-code/?size=240x240&data="
            + quote(code_url, safe="")
        )
    else:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill persists contact names and phone numbers into a local session file without any evident retention minimization, permission hardening, or explicit notice in this code path. That creates a local privacy exposure: anyone with access to the host account or filesystem can read sensitive personal data from prior deliveries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The inline documentation says diagnostic commands state show / state get 'directly print' and therefore are not affected by emit, but state_get at L0877-L0878 returns emit({"status": "ok", "session": session}). This is an active contradiction in intent/documentation about whether sensitive fields are filtered before reaching the LLM.

Content

No source excerpt is available for this finding.