Security audit

腾讯高考志愿填报

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as a Tencent CLI-backed gaokao tool, but its install, update, and CLI wrapper behavior are broad enough to require Review before install.

Install only if you trust TencentNews and the tencent-news-cli distribution path. Prefer reviewing the installer before execution, verify checksums or signatures where available, avoid sharing a real API key with the agent, and be aware that the skill may update or run the local CLI and send admissions-query details through it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill clearly instructs the agent to invoke shell wrappers (`sh scripts/cli-state.sh` and `sh scripts/run-cli.sh ...`) but does not declare corresponding permissions. That creates a capability/permission mismatch: reviewers or runtimes may underestimate the skill's ability to execute local commands, inspect environment state, and handle sensitive local configuration such as API key status.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The declared purpose is a gaokao advisory tool, but the embedded behavior includes local environment inspection, API key handling, version/update management, and effectively arbitrary CLI command execution through a wrapper. This broader operational scope increases the attack surface substantially and can be abused to run unintended commands, access local system details, or mislead users about what the skill is actually empowered to do.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The environment setup guide is for a different product (`tencent-news-cli`) and instructs users to obtain and configure a news API key unrelated to this gaokao application skill. This creates a supply-chain/integrity risk: users may install, trust, or provide credentials to the wrong tool, causing credential exposure, misconfiguration, and accidental execution of unintended commands.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The title, commands, and workflow explicitly direct the user to configure `tencent-news-cli`, which contradicts the declared purpose of a college application planning skill. In a security review, this mismatch is dangerous because it can socially engineer users into setting secrets for an unrelated service and undermine trust in what code or external systems the skill actually depends on.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The installation guide is for an unrelated `tencent-news-cli` rather than the declared gaokao college application skill, which is a strong indicator of skill/package mismatch or repurposing. This can mislead users into installing and trusting software outside the stated function of the skill, enabling supply-chain abuse or unauthorized code execution under false pretenses.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The document title and commands consistently present the skill as a news CLI, directly contradicting the stated college-application purpose. Such deliberate identity drift increases the likelihood of deceptive distribution, where users are induced to run software they would not otherwise trust if accurately labeled.

Intent-Code Divergence

High

Confidence: 93% confidence
Finding: The update guide is for "tencent-news-cli", which does not match the declared gaokao application skill. This mismatch strongly suggests a supply-chain or packaging integrity problem: users of the education tool could be redirected to install or trust an unrelated CLI and infrastructure. In this skill context, unrelated updater instructions are especially suspicious because they can mislead operators into fetching software outside the expected product boundary.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script for a gaokao college-application skill is hard-coded to discover and interrogate a different product, `tencent-news-cli`, including install paths and command resolution. This mismatch is not a harmless naming issue: it can cause the skill to inspect or interact with an unrelated executable on the user's system, creating a cross-skill trust violation and enabling unintended access to another tool's state and credentials.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file header describes generic CLI state reporting, but the implementation actually targets `tencent-news-cli`, which is inconsistent with the declared skill purpose. Misleading documentation obscures the true behavior of the script, making review and user consent harder and increasing the chance that unrelated tooling is silently queried.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The script is clearly oriented around a different product surface (`tencent-news-cli`) than the declared gaokao admissions tool. This kind of scope/identity mismatch is dangerous because it can cause users or the hosting agent to run unintended software, inspect unrelated local state, and interact with credentials outside the advertised purpose.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The operational behavior of this script is environment reconnaissance and credential-state inspection, not student admissions lookup or recommendation generation. In skill context, that broadens access from expected educational functionality into local system probing, which can violate user expectations and enable collection of sensitive installation and authentication details.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The wrapper for a gaokao college-application skill is hardcoded to discover and execute `tencent-news-cli`/`tencent-news-cli.exe`, which is inconsistent with the declared skill purpose. That mismatch can cause the skill to invoke the wrong binary from PATH, a global install directory, or the local skill folder, leading to unintended code execution and possible exfiltration of sensitive student score, rank, preference, and admissions-query data to an unrelated CLI.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The inline documentation explicitly states that the script executes `tencent-news-cli`, reinforcing the implementation mismatch rather than being an isolated comment typo. In this skill context, documentation that normalizes the wrong executable increases the chance reviewers and operators will miss that the wrapper is bound to an unrelated CLI, making accidental misuse and unsafe deployment more likely.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The wrapper for a gaokao application skill executes an unrelated binary, `tencent-news-cli`, from local, global, or PATH-controlled locations. This is dangerous because the skill may invoke functionality outside its declared purpose, creating a supply-chain/trust-boundary issue where users expecting education-related processing may instead run an unrelated executable with access to their inputs and environment. In this skill context, the mismatch increases risk because the binary name is materially inconsistent with the stated domain, making accidental or intentional misuse harder to detect.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: `resolve_command_cli_path` accepts the first `tencent-news-cli` found in the environment PATH and only performs a weak behavioral check (`help` exits successfully). This enables PATH hijacking: if an attacker can place a malicious executable earlier in PATH, the wrapper will execute it under the skill's trust context. The gaokao skill context makes this more dangerous because users may provide sensitive educational data while assuming a domain-specific trusted tool is being run.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The macOS/Linux instructions pipe a remotely fetched shell script directly into `sh`, which executes unreviewed network content immediately on the user's machine. In the context of a mislabeled skill, this is more dangerous because the user is already being directed to install software unrelated to the advertised function, magnifying the risk of arbitrary code execution.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The Windows instructions use `irm ... | iex`, which downloads and immediately executes remote PowerShell code without verification. Combined with the broader project mismatch, this creates a strong arbitrary-code-execution risk and could be used to deliver unwanted or malicious software under deceptive branding.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The guide instructs users to execute remote scripts directly via `curl ... | sh` and `irm ... | iex`, which grants immediate code execution to whatever is served from the remote URL at runtime. If the CDN content, DNS, transport path, or publisher account is compromised, users can be infected without reviewing the script first. Because this is presented as an update path in a mismatched skill, the surrounding context increases suspicion rather than reducing it.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script invokes `apikey-get` to determine whether an API key is configured, which probes sensitive credential state without any visible warning, consent prompt, or disclosure. Even though it does not print the key, checking credential presence on an unrelated CLI is privacy-sensitive and, in this skill context, especially suspicious because the probed CLI does not match the declared application domain.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script executes `apikey-get` and parses the returned value to determine whether a key exists. Even though it does not print the key directly, invoking a command that may emit the full secret creates unnecessary secret exposure in process output, shell variables, logs, crash traces, or downstream debugging, especially because there is no masking or safer status-only API.

External Script Fetching

High

Category: Supply Chain
Content: 用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
Confidence: 95% confidence
Finding: The skill instructs users to install software by piping a remote script directly into a shell (`curl ... | sh` / `irm ... | iex`). This is a classic high-risk pattern because any compromise of the remote host, CDN path, TLS termination, or update channel would immediately translate into arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.