T03 · Remote Payload Retrieval and Execution
Error
- Location
references/installation-guide.md:8- Finding
Unverified Remote Installers Are Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
Security audit
tencent-news
Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly coherent with its Tencent News CLI purpose, but it asks users to run remote installer scripts directly and handles API-key setup in ways that deserve review before installation.
Install only if you trust TencentNews and the remote installer source. Prefer downloading and inspecting or verifying the installer before running it, avoid pasting real API keys into chat, and be aware that API-key commands may enter shell history. Generated Gaokao HTML reports should be treated as potentially network-capable if CLI-provided logo URLs are included.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/env-setup-guide.md:10- Finding
API Key Is Entered Through a Command-Line Argument
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/gaokao-html-interaction-reference.html:173- Finding
Generated Offline Reports Can Load Untrusted Remote Logo URLs
- Content
View full analysis
- Remediation
View remediation
``` 7. Add static validation that fails report generation if any `http://` or `https://` resource remains in image, script, stylesheet, font, iframe, or media attributes. 8. Reconcile the specification by removing the rule that permits CLI-address logos when the report is required to be network-independent. ]]>
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a news/weather/gaokao information service, but its workflow also performs local environment inspection, installation state detection, update checks, and API key status handling. This mismatch weakens informed consent and can surprise users or platforms with host-level operations beyond ordinary content retrieval, making risky actions more likely to be approved or auto-run.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | macOS / Linux | `sh scripts/cli-state.sh` | `sh scripts/run-cli.sh <command> [args]` |
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The skill tells the agent to recommend one-line remote script execution (
curl ... | shandirm ... | iex) for installation. Piping network content directly into a shell/PowerShell interpreter removes an opportunity for inspection and makes compromise of the download source, CDN path, TLS interception, or content delivery chain immediately become arbitrary code execution on the user's machine.- Content
md 用户直接提出新闻、较真、天气、预警或高考业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
Fetching an external script from the internet and executing it as part of installation creates a direct remote code execution path on the endpoint. In this skill context, the file is an installation guide for a CLI tool, so users are specifically being encouraged to run privileged setup commands, making supply-chain compromise or malicious script replacement especially dangerous.
- Content
打开终端，执行以下命令：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The installation guide tells users to execute remotely fetched shell and PowerShell scripts directly via a pipe, which prevents meaningful inspection before execution and turns any CDN compromise, DNS/TLS interception failure, or publisher-side mistake into immediate arbitrary code execution on the user's machine. The claim that the script will 'verify' components does not mitigate the initial trust problem, because the untrusted bootstrap script itself is what gets executed first.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The '| sh' pattern is a classic unsafe chaining construct because it streams unreviewed remote content directly into an interpreter, eliminating the user's opportunity to inspect or validate what will run. If the remote content is altered, the result is immediate arbitrary command execution, potentially including persistence, credential theft, or environment manipulation.
- Content
打开终端，执行以下命令：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The command fetches a script from a remote host and immediately executes it via the shell, giving the remote content full control over the local system under the user's privileges. If the CDN, origin, DNS, TLS trust chain, or hosting path is compromised, or if content changes unexpectedly, this becomes an arbitrary code execution vector.
- Content
macOS / Linux：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | shWindows：
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The
| shchaining pattern is dangerous because it removes any inspection boundary between download and execution, causing untrusted network-delivered bytes to be interpreted as shell commands immediately. This increases the blast radius of any upstream compromise and makes accidental or malicious content execution more likely.- Content
macOS / Linux：
sh curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | shWindows：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to invoke shell scripts (
cli-state.sh,run-cli.sh) but does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization/containment gap: a host integrating this skill may not realize shell execution is required, increasing the chance of unintended command execution in environments that should have been read-only.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description says to use the skill whenever a user needs news, fact-checking, weather, or Gaokao planning, but it does not define explicit trigger phrases, scope limits, or negative examples. Because this is a manifest/markdown file, such broad activation language can cause unintended invocation for common everyday requests in those domains.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The routing table maps very broad user intents like news, weather, and fact checking to this skill, but it does not provide negative examples or strict scope constraints at the entry point. Although later sections add some detail, the top-level routing language remains broad enough to overlap with many ordinary user requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document declares
lang="zh-CN"and all visible UI text is Chinese, which imposes a specific language/locale on users. The file does not indicate that this locale is optional, user-selectable, or limited to a clearly documented region-specific use case.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide instructs users to execute remote installation scripts directly from the network without any warning, review step, checksum/signature verification, or explanation of system impact. Even if the vendor-controlled URL is legitimate, piping fetched content into a shell or PowerShell interpreter creates a supply-chain and content-swapping risk that can lead to arbitrary code execution on the user's machine.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill description and output template are entirely specified in Chinese, including the required source line
**来源：腾讯天气**, with no indication that users may choose another language. This is a natural-language locale constraint that appears mandatory rather than optional or region-justified within the file.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The script treats '未设置 API Key' and 'not set' as the recognized messages for an unset API key, embedding a specific language assumption into its behavior. This can violate language/locale flexibility expectations because other localized CLI outputs may not be handled and users are not given any language/locale choice.
- Content
Static analysis
No suspicious patterns detected.