ClawHub
Back to skill

Security audit

tencentcloud-sms-skill

Security checks for vulnerabilities and agentic risk

Overview

This Tencent Cloud SMS skill is mostly purpose-aligned, but it automatically installs unpinned packages and silently searches broad local config files for cloud credentials before high-impact SMS operations.

Review this before installing in a real Tencent Cloud account. Use a dedicated low-privilege CAM subaccount, run it in an isolated virtual environment, preinstall reviewed dependency versions yourself, and avoid letting the skill read generic shell or system config files for credentials. Treat SMS sending and template/sign changes as account-impacting actions that can cost money or affect customers.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/_common.py:24
Finding

Automatic Installation of Unpinned Runtime Dependencies

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_env.py:31
Finding

Implicit Credential Loading from Broad User and System Configuration Files

Content
View full analysis
dict: target_set = set(_REQUIRED_VARS) newly_loaded = {} for filepath in _ENV_FILES: if not os.path.isfile(filepath): continue parsed = _parse_env_file(filepath) if not (target_set & set(parsed.keys())): continue for key, value in parsed.items(): if key in target_set and key not in os.environ: os.environ[key] = value newly_loaded[key] = value return newly_loaded ``` `scripts/_common.py:15-19`: ```python sys.path.insert(0, os.path.dirname(os.path.abspath(__file__))) from check_env import _load_from_files _load_from_files() ``` ### Technical Analysis Importing `_common.py` automatically scans several shell startup files, a generic home-directory `.env` file, and system-wide environment files. Values for the two Tencent Cloud credential variables are loaded into the process without requiring an explicit credential-file argument or informing the caller which source was selected. The implementation only retains the expected Tencent variables, and the audit found no code that prints or sends the complete credential values to an unrelated destination. Nevertheless, the behavior expands the Skill's filesystem access beyond ordinary environment-variable consumption and implicitly trusts files that may have different ownership, permi ...[truncated 2205 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A second description-behavior mismatch indicates the skill claims broad SMS sending, analytics, and tracking capabilities while apparently only handling local template copying/opening and lacking real Tencent Cloud API interaction. This is risky because deceptive capability claims can be used to justify unnecessary local file operations and obtain trust or permissions unrelated to the true behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A second description-behavior mismatch indicates the skill claims broad SMS sending, analytics, and tracking capabilities while apparently only handling local template copying/opening and lacking real Tencent Cloud API interaction. This is risky because deceptive capability claims can be used to justify unnecessary local file operations and obtain trust or permissions unrelated to the true behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/国内短信群发模板.xlsx!/xl/theme/theme1.xml (reported line 2)May include surrounding context.

text
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office 主题​​"><a:themeElements><a:clrScheme name="Office"><a:dk1><a:sysClr val="windowText" lastClr="000000"/></a:dk1><a:lt1><a:sysClr val="window" lastClr="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="44546A"/></a:dk2><a:lt2><a:srgbClr val="E7E6E6"/></a:lt2><a:accent1><a:srgbClr val="4472C4"/></a:accent1><a:accent2><a:srgbClr val="ED7D31"/></a:accent2><a:accent3><a:srgbClr val="A5A5A5"/></a:accent3><a:accent4><a:srgbClr val="FFC000"/></a:accent4><a:accent5><a:srgbClr val="5B9BD5"/></a:accent5><a:accent6><a:srgbClr val="70AD47"/></a:accent6><a:hlink><a:srgbClr val="0563C1"/></a:hlink><a:folHlink><a:srgbClr val="954F72"/></a:folHlink></a:clrScheme><a:fontScheme name="Office"><a:majorFont><a:latin typeface="Calibri Light" panose="020F0302020204030204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="游ゴシック Light"/><a:font script="Hang" typeface="맑은 고딕"/><a:font script="Hans" typeface="等线 Light"/><a:font script="Hant" typeface="新細明體"/><a:font script="Arab" typeface="Times New Roman"/><a:font script="Hebr" typeface="Times New Roman"/><a:font script="Thai" typeface="Tahoma"/><a:font script="Ethi" typeface="Nyala"/><a:font script="Beng" typeface="Vrinda"/><a:font script="Gujr" typeface="Shruti"/><a:font script="Khmr" typeface="MoolBoran"/><a:font script="Knda" typeface="Tunga"/><a:font script="Guru" typeface="Raavi"/><a:font script="Cans" typeface="Euphemia"/><a:font script="Cher" typeface="Plantagenet Cherokee"/><a:font script="Yiii" typeface="Microsoft Yi Baiti"/><a:font script="Tibt" typeface="Microsoft Himalaya"/><a:font script="Thaa" typeface="MV Boli"/><a:font script="Deva" typeface="Mangal"/><a:font script="Telu" typeface="Gautami"/><a:font script="Taml" typeface="Latha"/><a:font script="Syrc" typeface="Estrangelo Edessa"/><a:font script="Orya" typeface="Kalinga"/><a:font script="Mlym" typeface="Kartika"/><a:font scri
...[truncated 26 chars]

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/国际港澳台短信群发模板.xlsx!/xl/theme/theme1.xml (reported line 2)May include surrounding context.

text
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office 主题​​"><a:themeElements><a:clrScheme name="Office"><a:dk1><a:sysClr val="windowText" lastClr="000000"/></a:dk1><a:lt1><a:sysClr val="window" lastClr="FFFFFF"/></a:lt1><a:dk2><a:srgbClr val="44546A"/></a:dk2><a:lt2><a:srgbClr val="E7E6E6"/></a:lt2><a:accent1><a:srgbClr val="4472C4"/></a:accent1><a:accent2><a:srgbClr val="ED7D31"/></a:accent2><a:accent3><a:srgbClr val="A5A5A5"/></a:accent3><a:accent4><a:srgbClr val="FFC000"/></a:accent4><a:accent5><a:srgbClr val="5B9BD5"/></a:accent5><a:accent6><a:srgbClr val="70AD47"/></a:accent6><a:hlink><a:srgbClr val="0563C1"/></a:hlink><a:folHlink><a:srgbClr val="954F72"/></a:folHlink></a:clrScheme><a:fontScheme name="Office"><a:majorFont><a:latin typeface="Calibri Light" panose="020F0302020204030204"/><a:ea typeface=""/><a:cs typeface=""/><a:font script="Jpan" typeface="游ゴシック Light"/><a:font script="Hang" typeface="맑은 고딕"/><a:font script="Hans" typeface="等线 Light"/><a:font script="Hant" typeface="新細明體"/><a:font script="Arab" typeface="Times New Roman"/><a:font script="Hebr" typeface="Times New Roman"/><a:font script="Thai" typeface="Tahoma"/><a:font script="Ethi" typeface="Nyala"/><a:font script="Beng" typeface="Vrinda"/><a:font script="Gujr" typeface="Shruti"/><a:font script="Khmr" typeface="MoolBoran"/><a:font script="Knda" typeface="Tunga"/><a:font script="Guru" typeface="Raavi"/><a:font script="Cans" typeface="Euphemia"/><a:font script="Cher" typeface="Plantagenet Cherokee"/><a:font script="Yiii" typeface="Microsoft Yi Baiti"/><a:font script="Tibt" typeface="Microsoft Himalaya"/><a:font script="Thaa" typeface="MV Boli"/><a:font script="Deva" typeface="Mangal"/><a:font script="Telu" typeface="Gautami"/><a:font script="Taml" typeface="Latha"/><a:font script="Syrc" typeface="Estrangelo Edessa"/><a:font script="Orya" typeface="Kalinga"/><a:font script="Mlym" typeface="Kartika"/><a:font scri
...[truncated 26 chars]

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_env.py (reported line 13)May include surrounding context.

python
~/.bashrc
    ~/.zshrc
    ~/.bash_profile
    ~/.env
    /etc/environment
    /etc/profile

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_env.py (reported line 36)May include surrounding context.

python
os.path.expanduser("~/.bashrc"),
    os.path.expanduser("~/.zshrc"),
    os.path.expanduser("~/.bash_profile"),
    os.path.expanduser("~/.env"),
    "/etc/environment",
    "/etc/profile",
]

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares shell, environment, and filesystem-affecting behavior but does not define any explicit tool scope such as allowed-tools or permissions. In an agent environment, that increases the blast radius because the host may permit broader command execution, file access, or environment inspection than users expect from an SMS-oriented skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill silently attempts to install a Python package during normal execution with only a generic info log. This is unsafe because it performs a side-effecting system change and executes installer logic from an external package source, potentially surprising operators and increasing supply-chain exposure in environments handling cloud credentials.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The code automatically executes pip install at runtime when the SDK is missing. Although it uses a fixed argument list rather than shell interpolation, it still triggers network access and code installation/execution without explicit user consent or integrity pinning, which can expose users to supply-chain risk or unexpected environment modification.

Content

Scanner excerpt · scripts/_common.py (reported line 30)May include surrounding context.

python
import tencentcloud  # noqa: F401  # pylint: disable=unused-import
    except ImportError:
        print("[INFO] tencentcloud-sdk-python not found. Installing...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "tencentcloud-sdk-python", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This behavior silently mutates the runtime environment by installing a Python package with only a generic informational message. In an agent skill context, operators may expect parsing an Excel file to be local-only; instead, the script may initiate network access and execute package installation logic, increasing supply-chain and change-management risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
94% confidence
Finding

The script automatically executes a pip installation when openpyxl is missing, which causes code from an external package index to be fetched and run in the current environment. Even though the command is hardcoded and not shell-injected, this is still risky because dependency installation is a privileged side effect that can introduce supply-chain compromise, unexpected environment changes, or execution of unreviewed package install hooks.

Content

Scanner excerpt · scripts/parse_bulk_template.py (reported line 42)May include surrounding context.

python
import openpyxl  # noqa: F401  # pylint: disable=unused-import
    except ImportError:
        print("[INFO] openpyxl not found. Installing...", file=sys.stderr)
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "openpyxl", "-q"],
            stdout=sys.stderr,
            stderr=sys.stderr,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script automatically queries Tencent Cloud's DescribeSmsTemplateList API using configured credentials in order to infer variable counts, but it does so without an explicit warning that running the parser will perform authenticated network requests. This can surprise users, leak operational metadata such as template IDs and access patterns to a remote service, and violate expectations for an offline file-parsing utility.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_bulk_template.py (reported line 75)May include surrounding context.

python
system = platform.system().lower()
    try:
        if system == "darwin":
            subprocess.Popen(
                ["open", str(path)],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_bulk_template.py (reported line 87)May include surrounding context.

python
if system == "linux":
            if _is_headless_linux():
                return False
            subprocess.Popen(
                ["xdg-open", str(path)],
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code executes a network-backed lookup using credentials supplied via environment variables and requests SMS delivery status tied to a specific phone number. Although the module docstring documents required environment variables and purpose, there is no visible runtime disclosure, prompt, or warning about handling potentially sensitive phone/message metadata before the operation runs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

On module load, the code immediately reads configuration files and populates environment variables as a side effect. The module docstring mentions environment-variable loading, but there is no explicit warning at the point of execution that simply importing this file will read local config sources.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/_common.py (reported line 297)May include surrounding context.

python
try:
        req = request_cls()
        req.from_json_string(json.dumps(params))
        resp = getattr(client, client_method_name)(req)
        output_json(json.loads(resp.to_json_string()))
    except TencentCloudSDKException as e:
        handle_api_error(e)

Static analysis

No suspicious patterns detected.