Security audit

tencent-news

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Tencent News CLI wrapper, but its setup/update path and diagnostics grant more local execution and credential-handling authority than a user may expect.

Review this before installing. It may be appropriate if you trust TencentNews and need the Tencent News CLI, but do not run the provided pipe-to-shell install/update commands unless you are comfortable executing remote code from that CDN. Prefer downloading and verifying the installer first, and avoid exposing your real API key in chats or logs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill directs the agent to execute shell scripts (`cli-state.sh`, `run-cli.sh`) but does not declare corresponding permissions or clearly surface this execution capability in a structured permission model. Hidden or undeclared shell access increases the risk that a user invoking a seemingly informational skill triggers local command execution without adequate review or sandboxing.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose presents the skill as a content-query tool, but the instructions also require system inspection, installation guidance, update flows, API-key management, and generic CLI command execution. This mismatch is dangerous because users and hosting platforms may grant trust appropriate for a low-risk news skill while the skill actually performs privileged local operations and credential-related workflows.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The guide instructs users to fetch and immediately execute remote code via `curl ... | sh` and `irm ... | iex`, which gives the remote host full code execution on the user's machine at install time. For a news/weather/gaokao information skill, this installation pattern is not necessary to deliver the stated functionality and significantly increases supply-chain and compromise risk if the CDN, DNS, TLS trust chain, or hosting pipeline is abused.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script determines whether an API key is configured by calling `apikey-get` and parsing the returned secret value itself. Even though it does not print the key, unnecessarily retrieving secret material expands exposure in process memory, command output capture, logs, and future maintenance changes, violating least-privilege for a state-reporting utility.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The installation commands execute network-fetched content immediately without any explicit warning that the user is granting arbitrary code execution privileges to a remote script. This is dangerous because users may treat the command as routine setup, while any compromise of the served script can lead to malware installation, credential theft, persistence, or broader system takeover.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The guide instructs users to execute remote scripts directly via `curl | sh` and `irm ... | iex`, which runs unverified code from the network with the user's privileges and provides no warning about the security risks. If the hosting location, CDN path, DNS, TLS trust chain, or script source is compromised, users could be exposed to arbitrary code execution and full system compromise.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This state script silently invokes a secret-retrieval command and inspects returned key material without informing the caller. In a skill context, users and orchestrators may reasonably expect a harmless diagnostics check, so hidden secret access increases the chance of accidental disclosure through telemetry, debugging, subprocess inspection, or later code reuse.

External Script Fetching

High

Category: Supply Chain
Content: 用户直接提出新闻、较真、天气、预警或高考业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
Confidence: 99% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into `sh`/`iex`, which is a classic high-risk pattern. If the remote host, CDN path, transport chain, or script contents are compromised, arbitrary code executes immediately on the user's machine with no opportunity for inspection.

Static analysis

No suspicious patterns detected.