Security audit

tencent-ses-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Tencent Cloud email purpose, but it asks users to share cloud API keys in chat and can perform high-impact email account actions.

Review before installing. Do not paste Tencent Cloud SecretId or SecretKey into an AI chat; configure them directly in a local environment or secret manager. Use a narrowly scoped CAM policy instead of broad SESFullAccess where possible, require dry-run plus explicit confirmation before sends or deletes, avoid SES_SCHEME/http or untrusted endpoints, and install dependencies in a pinned isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/ses_tool.py:71
Finding: Arbitrary API Endpoint and Plaintext Transport Can Expose SES Request Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:298
Finding: Workflow Instructs Users to Disclose Long-Lived Cloud API Credentials Through the AI Conversation
Content: View full analysis
"Using the email delivery function requires Tencent Cloud API credentials (SecretId and SecretKey). Please provide your SecretId and SecretKey, and I will help you complete the configuration." 2. **Guide the user to obtain the credentials securely**, following the steps in the security configuration guide. 3. **After the user provides the credentials, configure the environment variables**: ```bash export TENCENTCLOUD_SECRET_ID="" export TENCENTCLOUD_SECRET_KEY="" ``` ``` ### Technical Analysis The Skill explicitly directs the agent to ask the user to provide both the Tencent Cloud SecretId and SecretKey through the conversation. It then instructs the agent to place those user-provided values into environment variables. A SecretKey is a long-lived authentication secret and should never be transferred through an LLM conversation. Providing it in chat unnecessarily exposes it to multiple processing and retention surfaces, potentially including: - Conversation history - Model-provider processing - Agent traces and debugging logs - Monitoring and telemetry systems - Prompt context supplied to later tools or model calls - Screenshots, exports, or shared conversation records This workflow conflicts with the project’s own security guidance, which warns that credentials may pass through the LLM and should not be transmitted through unsafe channels. Environment variables are preferable to h ...[truncated 1586 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:89
Finding: Unpinned Runtime SDK Installation Creates a Mutable Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch is security-relevant because the skill declares broad end-to-end SES workflows, but also implies undeclared local file access for template content and attachments. Undeclared file-reading capability can cause users or reviewers to underestimate data exposure risk, especially when attachments or template files may include sensitive local content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: This mismatch is security-relevant because the skill declares broad end-to-end SES workflows, but also implies undeclared local file access for template content and attachments. Undeclared file-reading capability can cause users or reviewers to underestimate data exposure risk, especially when attachments or template files may include sensitive local content.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to ask users to provide cloud API secrets in conversation and then use them to configure the environment. This is dangerous because conversational channels may be logged, exposed to the LLM, retained in transcripts, or mishandled by downstream tooling, turning credential collection into a direct secret-exfiltration and account-compromise risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill advertises capabilities that rely on environment access, local file access, and network operations, but it does not declare any tool scope restrictions such as allowed-tools or permissions. This creates an overbroad execution surface where an agent runtime may grant more capability than reviewers or users expect, increasing the risk of unintended secret access, local file reads, or network calls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough to activate on common conversations about sending email, which can cause the skill to engage unexpectedly in contexts where users did not intend cloud-email operations. In a skill that may request credentials, inspect files, or perform network actions, over-triggering materially increases the chance of accidental sensitive-data handling or unintended actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The expanded trigger scope covers generic status, domain verification, and DNS troubleshooting language, so the skill may activate during ordinary support conversations unrelated to Tencent SES. Because the skill's documented workflow includes security-sensitive guidance and operational steps, this broad matching increases the risk of context confusion and inappropriate prompting for secrets or operational changes.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow builds trust through helpful setup guidance and then escalates to requesting sensitive credentials, which is a classic risky interaction pattern even if not overtly malicious. In the context of a cloud administration skill, this can normalize sharing secrets with the agent and make users more susceptible to credential disclosure, especially in ambiguous or over-triggered sessions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document notes that bulk email exposes the full recipient list, but presents this mainly as an operational note rather than a strong privacy/security warning. In an agent skill that automates email sending, this can lead to accidental disclosure of recipients' email addresses to all other recipients, creating a real privacy breach and possible compliance issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The module docstring and all user-facing command descriptions are presented in Chinese, establishing a fixed language for interaction. Under the stated policy, a skill should not force a specific language or locale unless it offers user opt-in or clearly documents a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: 技能清单主要宣称支持发信域名验证、发信地址管理、使用模板或自定义内容发信，以及发送状态查询；代码还额外实现了 list/get/create/update/delete-template 的完整模板管理工作流。模板管理会直接修改 SES 账户中的模板资源，超出了“使用模板发送邮件”的通常实现细节。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: manifest 描述了承诺式自动化行为：当域名验证失败或新建域名时自动启动认证向导，并进行全球 DNS 传播检测和 DNS 故障定位。实际代码在 get_domain/create_domain/verify_domain 中只是读取 SES 返回的 DNS 配置项和验证状态，既没有执行外部 DNS 查询，也没有实现传播检测、诊断器或向导式流程。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The tool exposes a destructive delete-template operation that executes immediately with no interactive confirmation, guardrail, or soft-delete behavior. In an agent skill context, where commands may be generated from ambiguous user intent or prompt-influenced automation, this increases the risk of accidental deletion of production email templates and service disruption.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file presents the skill entirely in Chinese and includes prescribed user-facing guidance in Chinese, but does not state that the user may choose another language. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: SQP-3 适用于所有文件类型。L101 用自然语言将 Unsubscribe 的语言限定为固定语言代码列表，但文档没有要求根据终端用户语言偏好进行选择，也未说明这是特定区域或合规场景下的限制，存在语言/locale 选择未获用户明确选择的政策风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file contains end-user instructional content exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: 文件级说明、命令帮助和用户输出均固定为中文，没有提供语言/locale 选择或说明这是仅面向中文用户的区域化工具。按规则，强制单一语言而未给予用户选择可能构成自然语言层面的语言策略问题。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: manifest 说明发送邮件工作流第(5)步会“自动查询邮件发送状态”。但 send_template_email 和 send_simple_email 在发送成功后仅打印 MessageId，并未继续调用 get_send_status 或安排任何自动轮询；状态查询只能通过 get-status 命令单独触发。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.