Security audit

体育赛事查询助手

Security checks for vulnerabilities and agentic risk

Overview

The sports queries fit the stated purpose, but setup executes unverified downloaded scripts and troubleshooting encourages bypassing security protections.

Review the recovery instructions before installing. Use a verified CLI release, explicitly approve installation or update changes, and keep security protections enabled. Ask your administrator about enterprise blocks, and enter API keys only in your local terminal.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明的用途是体育赛事信息查询，代码却执行认证凭据清除操作。该操作不属于所声明的查询能力，也不是完成赛事查询所必需的常规实现细节，且可能影响后续 CLI 访问。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code performs an explicit update operation and contains no schedule, score, livestream, or supported-competition query. Updating the CLI is a separate maintenance capability, not merely an implementation detail of the declared read-only sports lookup behavior. The chunk does not show the update command's internals, so specific network or filesystem effects cannot be established.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
| macOS / Linux | `sh scripts/cli-state.sh status` | `sh scripts/run-cli.sh <command> [args]` |

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
| Windows | `powershell scripts/cli-state.ps1 status` | `powershell scripts/run-cli.ps1 <command> [args]` |

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: Both the Unix and Windows commands execute remotely fetched script content immediately, without a pinned version or independently verified integrity or signature. Although the HTTPS URL appears consistent with the Tencent integration, compromise of the publishing infrastructure could yield arbitrary code execution under the agent's account, potentially exposing credentials and writable files; installation checks do not mitigate that supply-chain risk.
Content: Scanner excerpt · references/cli-environment.md (reported line 24)May include surrounding context.
md
保持同一运行账号、PATH、HOME、安装目录、shell 和凭证上下文；新建目录、解压或切换源码不代表环境失效。已有本会话的有效状态可复用，发生鉴权错误或环境变化后重新检查。 1. **检查状态**：执行上表对应平台的状态命令。包装脚本缺失、执行失败或 JSON 无法解析时先核实完整包和脚本解释器，不能直接判为 CLI 未安装。 2. **缺少 CLI**：仅状态脚本确认 `cliExists: false` 时安装。`command not found` 可能只是 PATH 未命中；脚本还会检查固定安装目录。macOS / Linux：`curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows：`irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。安装后在当前对话复查，无需让用户重开终端、重新提问；失败时提供 [安装指南](installation-guide.md)，不循环重装。 3. **需要更新**：`update.needUpdate: true`、CLI 明确提示版本过旧或当前帮助不支持所需能力时，按 [更新指南](update-guide.md) 更新并重新读帮助。测试环境先核实 `run-cli version` 的下载渠道；若指向 `/hub/`，不要执行会切回正式构建的更新，使用已核实的测试构建及同渠道校验文件。不能仅凭安装脚本位于 `/test/` 或版本号相同就认定构建正确；来源不明时说明缺口，不猜下载地址。 4. **Key 缺失先核实**：`apiKey.status: missing` 不等于用户从未配置。macOS / Linux 可执行以下命令，只列出配置文件名，不读取或记录 Key 值：

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The command downloads a mutable remote installer and immediately executes it without an independently verified signature or pinned digest. HTTPS protects transport but does not prevent a compromised publishing account or CDN from supplying malicious code, which would run with the invoking user's permissions and could access credentials or modify shell startup files. Installation is relevant to this sports-query skill, but the installer's claimed verification of subsequent downloads does not authenticate the bootstrap script itself.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The pipe into sh converts the network response directly into executable shell instructions, eliminating a separate verification step before execution begins. This is the execution mechanism of the SC2 finding, not evidence of a distinct malicious chaining attack; its plausible installation purpose does not remove the supply-chain risk.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The command downloads a mutable remote script and immediately executes it without independent integrity or authenticity verification. If the publishing account, CDN content, or delivery infrastructure is compromised, the substituted script can execute arbitrary commands with the user's permissions; HTTPS alone does not protect against a compromised publisher. The apparent vendor-related URL and legitimate update purpose are not evidence of malicious intent, but do not eliminate this supply-chain risk.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The pipe to sh turns remotely supplied bytes directly into executable commands, removing the opportunity to verify the complete script before execution. This is the same underlying issue identified by SC2, not evidence of a separate malicious command chain; the manual installation context explains its presence but does not prevent arbitrary code execution if the remote content is compromised.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

The recovery workflow instructs the agent to download and execute remote installation scripts without first warning the user about code execution and installation changes.

Medium

Category: Output Handling
Confidence: 93% confidence
Finding: The recovery workflow authorizes installation automatically when the CLI is missing, without requiring disclosure of system changes or explicit user approval. A sports-schedule query does not inherently authorize installing software, and checking that the CLI is absent does not establish permission to modify the execution environment.
Content: No source excerpt is available for this finding.

Troubleshooting instructs users to bypass macOS and Windows security warnings without explaining the risks.

Medium

Category: Output Handling
Confidence: 97% confidence
Finding: The troubleshooting guidance tells users to override macOS and Windows security warnings without first establishing the downloaded software's authenticity. Although unsigned legitimate tools can trigger these warnings, normalizing bypasses alongside remote-script installation increases the chance that users will run a tampered or substituted executable.
Content: No source excerpt is available for this finding.

The recovery instructions recommend overriding operating-system and enterprise security blocks without warning about the risks.

Medium

Category: Output Handling
Confidence: 98% confidence
Finding: The recovery instructions direct users to override macOS Gatekeeper and select “Trust” or “Allow” for enterprise security or network blocks without first verifying the executable or obtaining administrator approval. This can enable an untrusted or compromised CLI to run or communicate despite protective controls, and a sports-schedule lookup does not justify such bypasses. Requiring user confirmation before retrying limits automatic execution but does not make the recommended overrides safe.
Content: No source excerpt is available for this finding.

The fallback installation instructions execute remotely downloaded scripts without warning about the trust and system-modification implications.

Medium

Category: Output Handling
Confidence: 96% confidence
Finding: The fallback instructions recommend immediately executing downloaded shell or PowerShell scripts without explaining that they can modify the system with the invoking user's permissions. A manual update guide is a legitimate context for installation instructions and reduces autonomous-execution risk, but users are not given a verification step or meaningful warning before crossing this trust boundary.
Content: No source excerpt is available for this finding.

The status check silently changes executable permissions on the detected CLI.

Medium

Category: Output Handling
Confidence: 95% confidence
Finding: The script is described as reporting installation, update, and API-key status, but this command modifies the detected CLI's filesystem permissions without a prompt, log, or explanatory comment. The same undisclosed permission change is repeated at L125; modifying executable permissions is not inherent to a read-only status check.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.