Security audit

jiaozhen-factcheck

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with Tencent fact-checking, but it asks agents or users to install/update a local CLI through remote shell scripts without integrity verification.

Review this skill before installing if you are not comfortable with a Tencent CLI being installed or updated on your machine. Prefer downloading and verifying installers manually instead of piping remote scripts into a shell, and do not share your real API key with the agent or paste it into chat logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The public description presents a narrow fact-checking tool, but the instructions authorize broader local system interaction: environment discovery, CLI installation/update, API key state inspection, and arbitrary subcommand forwarding via `run-cli`. That mismatch reduces informed consent and increases the chance the agent performs privileged local actions a user did not expect from a simple fact-check skill.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file is an installation guide for a Tencent news CLI, which does not align with a fact-checking skill’s declared purpose. This kind of capability mismatch is dangerous because it can hide unrelated or supply-chain-affecting behavior inside a skill users would trust for informational analysis, increasing the chance of unnoticed misuse or unexpected execution paths.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: This script enumerates local CLI installation details, update status, and API key configuration, which is unrelated to the declared fact-checking purpose of the skill. In a skill context, collecting environment and credential-state metadata expands access beyond user expectations and can expose sensitive operational information that could be misused by the skill or any downstream component.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The file behavior materially differs from the skill's stated purpose: instead of fact-checking claims, it performs local diagnostics on a Tencent News CLI and API key state. This kind of capability mismatch is dangerous because it can hide sensitive host inspection inside an innocuous-looking skill, undermining user trust and enabling covert data collection in a context where such access is not justified.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script for a fact-checking skill performs unrelated local CLI discovery, version probing, and API key status inspection. This violates the declared trust boundary of the skill and can expose sensitive environment details or credential presence to downstream components without a clear user need, which is especially risky because the capability is hidden behind an unrelated skill description.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The manifest describes a fact-checking tool, but the implementation only enumerates local tool state and whether an API key is configured. This mismatch is dangerous because it can mislead users and orchestrators into granting or invoking the skill under false pretenses, enabling stealthy collection of host reconnaissance and secret-adjacent information.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide instructs users to pipe remotely fetched scripts directly into `sh` and `iex`, which prevents meaningful inspection before execution and creates a classic supply-chain/RCE risk. The surrounding troubleshooting advice also normalizes bypassing macOS and Windows security warnings, making social engineering and malicious script substitution more effective if the host or distribution path is ever compromised.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide tells users to pipe a remotely fetched shell script directly into `sh` and a PowerShell script into `iex`, which executes network content without prior inspection, signature verification, or integrity checks. If the CDN, distribution path, or transport trust is compromised, users could run arbitrary code on their machines; because this is an update path, users may be especially likely to trust and execute it.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script executes an external CLI command to determine whether an API key is configured, without any disclosure in this file that local credential-related state will be queried. Even if it does not print the secret value, probing for credential presence and parsing CLI output can leak sensitive environment information and creates an unnecessary trust boundary crossing for a fact-checking tool.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script calls `apikey-get` and parses the returned key material to determine whether a key exists, without any user-facing warning, consent, or minimization. Even though it does not print the key directly, it accesses secret-bearing output and creates an unnecessary pathway for credential exposure through logs, errors, or future code changes.

External Script Fetching

High

Category: Supply Chain
Content: 用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
Confidence: 98% confidence
Finding: The skill instructs the agent to recommend `curl ... | sh` and `irm ... | iex`, which are classic remote-script execution patterns. If followed, users may execute unreviewed code fetched over the network directly in a shell, creating a supply-chain and remote code execution risk if the endpoint, transport, or hosting account is compromised.

Static analysis

No suspicious patterns detected.