T03 · Remote Payload Retrieval and Execution
Error
- Location
references/installation-guide.md:8- Finding
Unverified Remote Installation and Update Scripts Are Executed Immediately
- Content
View full analysis
- Remediation
View remediation
Security audit
腾讯高考志愿填报
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent with its Gaokao admissions purpose, but it should be reviewed because it tells users to run unverified remote installer scripts and bypass operating-system security warnings.
Install only if you trust TencentNews and are comfortable running a native CLI. Prefer downloading installers from a verified source, checking signatures or hashes, and avoiding pipe-to-shell commands; do not bypass Gatekeeper or SmartScreen unless you have independently verified the binary, and avoid entering real API keys in commands that may be logged.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/installation-guide.md:25- Finding
Installation Guide Encourages Bypassing Operating-System Trust Warnings
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/env-setup-guide.md:13- Finding
API Key Is Supplied Through Process Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (35)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about a high-school exam application and recommendation tool handling gaokao score, rank, admission, subject-selection, and志愿填报 data. The provided code does none of that. Instead, it is a system/CLI state diagnostic script for a different product (
tencent-news-cli). Its primary purpose is to detect a local executable, inspect version/update information, and check API key configuration. These are materially different behaviors and capabilities from the declared education/admissions workflow, so this is a clear description-behavior mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is for a college-application recommendation and admissions-data query tool. The supplied code does not implement any gaokao-domain functionality such as querying score tables, province control lines, school/major admission history, generating recommendation schemes, or producing HTML reports. Instead, it is an execution wrapper for a separate program called tencent-news-cli: it discovers the executable, parses SKILL.md for name/version, compares versions, and conditionally appends a --caller flag. That is a materially different primary purpose and introduces undeclared behavior related to invoking another CLI and passing metadata-derived caller identification.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill instructs users to install software via
curl ... | shand PowerShellirm ... | iex, which executes remote script content directly without prior verification. If the remote host, network path, or distribution endpoint is compromised, users could run arbitrary code on their machine, making this especially dangerous in a skill that already expects shell access and local CLI installation.- Content
md 用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 生成页面前必须读取 [`references/gaokao-html-interaction-reference.html`](references/gaokao-html-interaction-reference.html)，先复用其中已经验证的 `data-tab-group` / `data-tab-pan
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 生成页面前必须读取 [`references/gaokao-html-interaction-reference.html`](references/gaokao-html-interaction-reference.html)，先复用其中已经验证的 `data-tab-group` / `data-tab-pan
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 生成页面前必须读取 [`references/gaokao-html-interaction-reference.html`](references/gaokao-html-interaction-reference.html)，先复用其中已经验证的 `data-tab-group` / `data-tab-pan
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The environment setup guide for a gaokao college application skill instructs users to obtain and configure an API key for an unrelated
tencent-news-clitool. This mismatch can misdirect users into installing or authenticating the wrong software, causing credential exposure, operational confusion, or accidental invocation of unintended capabilities under the guise of the intended skill.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is an installation guide for an unrelated tool, 'tencent-news-cli', while the skill claims to be a gaokao college application tool. This mismatch is dangerous because it can mislead users into installing and trusting software outside the declared scope, and in this case the guide also points to remote script execution, increasing the chance of unintended code execution or supply-chain abuse.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
This command fetches a shell script from an external host and executes it immediately, creating a direct remote code execution path tied to the integrity of the remote server, CDN, and transport chain. In the context of a skill that should help with college application data, embedding such installer behavior is especially suspicious because it is unrelated to the core function and broadens the attack surface unnecessarily.
- Content
打开终端，执行以下命令：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide tells users to pipe remote content directly into sh and iex, which executes downloaded code without giving the user a chance to inspect it. This is a classic unsafe installation pattern that enables server compromise, CDN tampering, or content substitution to become immediate arbitrary code execution on the user's machine.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The '| sh' construct is dangerous because it chains network retrieval straight into command execution, bypassing manual inspection and making any upstream compromise instantly exploitable. If the fetched content changes maliciously, the user will execute attacker-controlled commands with their local privileges.
- Content
打开终端，执行以下命令：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is an update guide for 'tencent-news-cli', which does not match the declared gaokao college-application skill. This kind of cross-project or misplaced documentation can misdirect users into installing or updating unrelated software, increasing supply-chain and social-engineering risk because users may trust the skill package context and run commands they did not intend to execute.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The command fetches a shell script from an external URL and immediately executes it. This creates a direct remote code execution path: if the hosted script or delivery channel is altered, users will run attacker-controlled code with their local privileges.
- Content
macOS / Linux：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | shWindows：
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The '| sh' pipeline removes any pause for validation and executes network-fetched content immediately. This chaining pattern is especially risky because it normalizes blind execution and makes it easy for malicious or tampered content to achieve immediate code execution.
- Content
macOS / Linux：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | shWindows：
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script is packaged as part of a gaokao college-application skill, but it probes and reports on a different product,
tencent-news-cli. This kind of cross-tool mismatch is dangerous because it can cause the agent to execute or trust an unrelated binary on the user's system, potentially exposing local state such as install paths, version data, and API-key configuration for software outside the declared skill scope.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script is hard-coded to inspect and execute an unrelated binary,
tencent-news-cli, from a corresponding install directory, which does not match the declared gaokao application skill. This creates a cross-skill integrity issue: a user invoking this skill may unknowingly trigger a different local program, allowing unintended command execution, environment probing, and misleading state reporting outside the skill’s stated purpose.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The wrapper for a gaokao college-application skill resolves and executes
tencent-news-cli/tencent-news-cli.exefrom PATH, a local file, or an install directory, which is materially inconsistent with the declared skill purpose. This can cause the skill to invoke an unrelated binary under trusted workflow context, enabling unintended data exfiltration, incorrect actions, or execution of a trojanized similarly named CLI if present on the system.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill requires shell execution (
sh scripts/cli-state.sh,sh scripts/run-cli.sh) but does not declare an explicit tool scope or allowed-tools boundary. That creates a trust and containment problem: a host may grant broader shell access than users expect, increasing the blast radius if the skill is modified or its wrapper scripts are compromised.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description and service boundary state that it serves Chinese regular-batch gaokao candidates and all user-visible outputs are defined in fixed Chinese wording. This is a natural-language locale policy constraint presented as mandatory behavior, with no user choice or opt-in mechanism documented in the file.
- Content
Static analysis
No suspicious patterns detected.