Security audit

jiaozhen-factcheck

Security checks for vulnerabilities and agentic risk

Overview

This fact-checking skill is coherent, but it directs users toward unverified remote installer execution and OS warning bypasses for an external CLI.

Review this skill before installing. It depends on Tencent's external CLI and may ask you to run installer or update commands that immediately execute remote code. Only proceed if you trust the Tencent distribution channel, can verify the installer or binary independently, and are comfortable with local CLI execution plus API-key status checks. Do not bypass OS security warnings unless you have verified the publisher and integrity yourself.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:37
Finding: Unverified Remote Installer Download and Immediate Execution
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/installation-guide.md:25
Finding: Users Are Instructed to Override Operating-System Execution Warnings
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill delegates core behavior to an external Tencent News CLI and describes additional runtime behaviors such as metadata reading, caller injection, discovery, and process execution that are not reflected in the declared purpose or permissions. Offloading trust to an external executable materially expands the attack surface because the security properties now depend on a separately installed binary and its invocation wrapper, not just the skill text.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill delegates core behavior to an external Tencent News CLI and describes additional runtime behaviors such as metadata reading, caller injection, discovery, and process execution that are not reflected in the declared purpose or permissions. Offloading trust to an external executable materially expands the attack surface because the security properties now depend on a separately installed binary and its invocation wrapper, not just the skill text.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (curl ... | sh) or PowerShell (irm ... | iex). This is a classic supply-chain risk: if the remote content, hosting path, DNS, CDN, or TLS trust chain is compromised, arbitrary code will execute immediately on the user's machine without review.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: This is explicit external script fetching from a remote CDN followed by execution, which creates a trust-on-first-use remote code execution path. In the context of an installation guide for a fact-checking skill's CLI, this is more dangerous because users are primed to trust the official setup steps and may run them without scrutiny.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | sh pipeline is dangerous because it chains untrusted network content directly into a shell interpreter, bypassing inspection and making exploitation trivial if the fetched content is modified. This pattern amplifies the risk of the external fetch by converting it immediately into command execution.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

External Script Fetching

High

Category: Supply Chain
Confidence: 96% confidence
Finding: This finding is a concrete instance of external script fetching coupled to execution: the command retrieves a script from the internet and immediately runs it. In documentation for an update path, this is especially risky because users are primed to trust maintenance instructions and may execute the command without scrutiny.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | sh chaining pattern is dangerous because it converts downloaded network content directly into executable shell input, eliminating review and increasing the blast radius of any compromise in the upstream source. The fact that this appears in a manual update guide makes the social-engineering aspect stronger, since users are likely to treat it as an endorsed administrative action.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file implements host inspection and installer/credential diagnostics for tencent-news-cli, which is unrelated to the manifest’s stated fact-checking functionality. That hidden capability expands the skill’s privileges and data access beyond user expectations, making it risky even if not overtly malicious, especially in an agent ecosystem where mismatched capabilities can facilitate unauthorized system reconnaissance.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to invoke shell scripts and local CLI commands, but the skill metadata does not declare any corresponding tool scope or allowed-tools boundary. This creates an authorization and transparency gap: a caller may believe the skill only performs fact-checking, while it can actually execute shell-based local actions and inspect local environment state.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The invocation description includes broad phrases such as “能否xxx”, “可不可以”, “是真的吗”, and “真的假的”, which commonly appear in ordinary conversation outside the fact-checking context. Because the trigger scope is not bounded by explicit exclusions or a narrow interface context, the skill could be invoked unintentionally.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The primary description is written entirely in Chinese and frames usage in Chinese-language trigger terms, while the document does not state that the skill is intentionally restricted to Chinese-speaking users or offer language selection. This can violate language/locale policy when a skill implicitly enforces one language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide instructs users to fetch and immediately execute a remote shell script via curl | sh, which removes the opportunity to inspect the script before execution and gives the remote host full code-execution capability on the user's machine. Even if the domain is legitimate today, CDN compromise, DNS hijack, or upstream script tampering would turn this into silent arbitrary code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Windows command uses irm ... | iex, which directly downloads and executes remote PowerShell code in memory without review. This is a well-known dangerous pattern because any compromise of the hosting path or script content results in immediate arbitrary code execution on the user's system.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide instructs users to stream a remotely fetched shell script directly into sh, which executes code without allowing inspection, integrity verification, or provenance checks. If the CDN, DNS, transport path, or hosting account is compromised, users could immediately run attacker-controlled code on their systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Windows instructions fetch a remote PowerShell script and pass it directly to iex, which executes unreviewed remote code in the current user context. This creates the same supply-chain and interception risk as pipe-to-shell, and can lead to arbitrary command execution if the remote content is ever altered maliciously.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script actively invokes tencent-news-cli apikey-get and parses the returned key material, even though it ultimately only reports whether a key is present. Retrieving the full secret unnecessarily increases exposure risk: the key may appear in process output, error logs, telemetry, or future code changes, and this is done without any user-facing notice or consent flow.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script resolves tencent-news-cli from PATH and then executes it with help, version, and apikey-get. In an agent or plugin context, executing whatever binary is first on PATH creates a command-hijacking risk and gives this skill broader code-execution capability than its declared fact-checking purpose requires. The skill-context mismatch increases concern because users would not expect a fact-checking skill to run local binaries or inspect host state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script invokes apikey-get and parses the output to determine whether an API key is configured. Even though it does not emit the key directly, probing credential state without disclosure is sensitive host introspection and may reveal security posture or interact with secrets-handling code unexpectedly. In a fact-checking skill, this is less justified and therefore more dangerous from a privacy and trust perspective.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill manifest describes a fact-checking tool for assessing truthfulness of claims, but this script is explicitly documented and implemented as a launcher for tencent-news-cli. Nothing in the file indicates fact-check-specific behavior; instead it resolves, probes, and executes a news-oriented external CLI, which is a semantic mismatch unless the underlying CLI is itself the fact-check engine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.