Tencent MPS

• Outcome: Review
• Latest audit: Aug 9, 2026 · 3:01 PM UTC
• Version: 1.3.2

Overview

This is mostly a disclosed Tencent Cloud media-processing skill, but it needs Review because it combines cloud credential use, automatic media upload/link generation, runtime package upgrades, and an explicit duplicate-detection evasion workflow.

Install only if you intend to let the agent run these scripts with Tencent Cloud/COS credentials. Use a dedicated least-privilege Tencent Cloud account and bucket, avoid sensitive or third-party media unless authorized, prefer dry-run first, treat generated links and logs as sensitive, and do not use the dedupe, voice cloning, face swap, watermark removal, or similar workflows to bypass platform rules or process content without permission.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (80)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs
    print(f"⏳ 正在自动安装/升级缺失依赖：{', '.join(specs)}", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(
            f"❌ 自动安装失败，请手动执行:\n"

• Confidence: 89% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill directs the agent to use shell commands, read local reference files, access environment variables, and interact with networked cloud services, yet no explicit permission declaration is present. This creates a real trust-boundary problem: an orchestrator or reviewer may underestimate the skill's capabilities, increasing the chance of unintended credential exposure, filesystem access, or remote actions against Tencent Cloud resources.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The document explicitly states the feature's purpose is to modify video content to evade platform duplicate-content detection, which operationalizes abuse rather than a legitimate media-processing workflow. In this context, the skill is not merely transforming media; it is instructing users how to bypass trust-and-safety or anti-spam enforcement on third-party platforms.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The script automatically loads cloud credentials not only from the current environment but also from local dotenv and shell-init files, broadening the trust boundary and causing implicit secret access during routine use. In an agent or shared execution environment, this can unintentionally consume high-privilege credentials from user home directories or skill-local files without explicit consent, increasing the risk of unauthorized cloud actions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The script’s stated purpose is task-status inspection, but it also generates and prints COS presigned download URLs for output objects. That expands the capability from metadata lookup to granting temporary object access, which can expose processed media to anyone with terminal/log access and violates least-privilege expectations for a read-only status tool.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: Automatically loading credentials from system dotenv locations expands the script's access beyond explicit user-provided inputs and can cause it to consume secrets from unrelated projects or shell profiles. In an agent skill context, this weakens consent boundaries and increases the chance of unintended credential use when the operator did not mean to authorize this script with ambient secrets.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The environment loader imports and executes `mps_auto_upgrade.check_sdk_version()` before loading configuration. In a security-sensitive helper whose job is only to read credentials, this creates an unnecessary code-execution path that may perform package installation, network access, or other side effects before trust boundaries are established. If the helper or import path is compromised, invoking this script can trigger unintended execution with the user's privileges.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: A module presented as a polling utility also includes write-capable upload functionality that can transmit arbitrary local files to COS using ambient cloud credentials. In an agent-skill context, this increases risk because a caller may import or invoke the helper expecting read-only status checks while actually gaining a network exfiltration primitive.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation states that local files are automatically uploaded to COS and then converted into pre-signed URLs for API submission, but it does not clearly warn users about the privacy and data-handling implications of sending local content to cloud storage and then exposing it via a signed link. In a media-processing skill, users may provide sensitive images, so insufficient disclosure can lead to accidental external transmission of confidential data.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The markdown explains that COS object references are turned into pre-signed URLs before being passed to the API, but it does not prominently warn that this changes an internal object reference into a bearer-style URL that can be consumed externally during its validity window. If users assume COS keys remain internal-only, they may unintentionally expose media objects beyond their expected trust boundary.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly supports uploading local media to COS and submitting remote media URLs for cloud-side processing, but it does not warn users that audio/video content may be transferred to Tencent Cloud services and potentially contain sensitive personal, biometric, or confidential data. In this skill context, that omission is meaningful because the described workflows include speech recognition, video understanding, and comparison analysis, which commonly involve highly sensitive content and create a realistic risk of unintentional data disclosure or privacy non-compliance.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly encourages passing SecretId and SecretKey via command-line parameters or environment variables without any warning about exposure risks. Command-line secrets may be visible in shell history, process listings, logs, or debugging output, which can lead to credential compromise and unauthorized access to COS resources.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger rules are broad enough to auto-route requests containing phrases like '视频去重' or '规避重复检测' directly into an evasive workflow without requiring clarification of legitimate intent. This increases the chance of unintended or policy-violating invocation and makes misuse easier by reducing friction for harmful requests.

Missing User Warnings

Medium

• Confidence: 73% confidence
• Finding: The examples and parameter guidance encourage uploading, downloading, and processing videos via URL, local files, and COS, but provide no warning about privacy, copyright, consent, or data-handling implications. Because the documented use case includes modifying third-party media to avoid detection, the absence of safety and data-use warnings materially increases the risk of misuse.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation states that local files are automatically uploaded to COS and then sent to the API, but it does not give a clear privacy or data-handling warning before users provide potentially sensitive documents. In this skill context, users may upload PDFs, PPTs, DOCXs, or images containing confidential business, personal, or regulated data, so omission of disclosure increases the risk of unintended data exfiltration to cloud storage and downstream processing services.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document describes voice cloning and remote media processing workflows but does not warn users about consent, privacy, biometric voice data sensitivity, or the risks of uploading audio/video to third-party cloud services. In this context, omission is security-relevant because users may submit another person’s voice or sensitive recordings without authorization, creating privacy, compliance, and impersonation risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that `--local-file` will be automatically uploaded to COS for processing, but it does not clearly warn users about the privacy and data-handling implications of that upload. In a media-processing skill, local files may contain sensitive video, audio, faces, license plates, or embedded personal data, so silent cloud upload can cause unintended disclosure or compliance issues.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `--notify-url` parameter is documented as an optional callback URL, but there is no warning that task completion callbacks may disclose task metadata, output locations, or other processing details to the specified endpoint. If users provide a third-party, mistyped, or attacker-controlled URL, media-processing results and workflow metadata could be leaked outside the intended trust boundary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that local files will be automatically uploaded to COS to generate links, but it does not warn users that local media may leave the local environment and be transferred to cloud storage. In a media-processing skill, users may supply sensitive videos, images, or documents, so silent upload behavior can cause unintended disclosure, compliance issues, or unexpected persistence in remote storage.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation instructs users to upload source images to Tencent Cloud MPS and store outputs in COS, but it does not warn that those images may contain personal, confidential, or regulated data. In a media-processing skill, this omission can lead users to send sensitive content to third-party cloud services or expose results via accessible COS URLs without considering retention, access control, or compliance obligations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document explains how to submit images, OCR requests, and image-question prompts to Tencent Cloud MPS, but it does not clearly warn that uploaded/local images and their extracted contents may be transmitted to and processed by an external cloud service and potentially AI models. This can cause unintentional disclosure of sensitive personal, financial, document, or proprietary data, especially because the skill explicitly supports OCR, document understanding, and local-file upload scenarios.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The document explicitly supports sending user-provided local files, public URLs, and COS objects to Tencent Cloud MPS/COS for processing, but it does not clearly warn that this transfers image data to external cloud services and may expose sensitive or regulated content. In a media-processing skill, this is contextually expected behavior, so it is not inherently malicious, but the lack of an explicit privacy and data-transfer notice can lead users to unknowingly upload personal or confidential images.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly supports uploading local model and clothing images to COS and returning direct download URLs, but it does not warn users that personal images will be transferred to cloud storage and may be exposed via accessible links. In this skill’s context, the inputs are often human photos and apparel images, so the omission increases privacy risk and can lead to unintended disclosure of sensitive or identifying content.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that a local file will be 'automatically uploaded to COS' for processing, but it does not prominently warn that user-supplied images leave the local environment and are transmitted to cloud storage. This can lead to unintentional disclosure of sensitive or regulated image data, especially in workflows involving personal photos, IDs, medical images, or confidential business content.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation explicitly states that a local file path will be automatically uploaded to COS and that processed output may be downloaded locally, but it does not warn about data transfer, remote storage, persistence, bandwidth/cost implications, or local filesystem side effects. In an agent-driven workflow, this can cause users to unintentionally exfiltrate sensitive local media or write files to disk without informed consent, especially when the skill is triggered from natural-language requests.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:40