Security audit

腾讯天气预警

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed one-time Tencent weather lookup, but it asks users to install and update a local CLI through unverified remote shell commands that can execute code on their machine.

Review before installing. The weather-query behavior itself is narrow, but installation asks you to run remote code directly and configure a Tencent API key. Prefer a verified installer, checksum or signed package, and avoid running the setup command from an elevated/admin shell. Do not provide your real API key to the agent; enter it locally only if you trust the Tencent CLI and installer path.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/installation-guide.md:8
Finding: Unverified Remote Installer Is Executed Directly by the User's Shell
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a weather warning tool but relies on a more general Tencent News CLI and includes discovery/probing behavior unrelated to a minimal weather lookup. That discrepancy increases the risk of hidden functionality and reduces transparency around what the agent may inspect or execute locally.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill presents itself as a weather warning tool but relies on a more general Tencent News CLI and includes discovery/probing behavior unrelated to a minimal weather lookup. That discrepancy increases the risk of hidden functionality and reduces transparency around what the agent may inspect or execute locally.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into sh or iex, which is a classic high-risk pattern. If the remote host, CDN path, TLS trust chain, or delivered script is compromised, arbitrary code will execute immediately on the user's machine with the user's privileges.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The installation guide is mismatched to the declared skill: it installs and references a Tencent news CLI rather than the weather-alert skill. This creates a supply-chain and user-deception risk because operators may install an unrelated executable and grant it trust, environment access, and execution rights under the assumption it belongs to the weather tool.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The guide fetches an external script from a CDN and treats it as trusted installation logic. External script fetching is dangerous because trust is shifted to a mutable remote resource; if that resource is replaced or intercepted through upstream compromise, the installation path becomes an initial-access vector.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into sh executes unreviewed code immediately with the user's privileges, eliminating any meaningful opportunity to inspect content, validate integrity, or detect compromise. If the CDN, path, DNS, TLS trust chain, or publisher workflow is abused, users will run attacker-controlled code on their systems.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | sh chain is specifically risky because it converts a download operation directly into code execution in a single step. This chaining removes validation boundaries and makes accidental or malicious content execution far easier, especially in a skill context where users may copy commands without scrutiny.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Using irm ... | iex has the same remote-code-execution risk on Windows: downloaded PowerShell content is executed immediately without review or integrity verification. A compromised hosting path or tampered script could install malware, alter system settings, steal credentials, or establish persistence.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This command retrieves a shell script from an external URL and executes it, creating a direct remote-code-execution path on the user's system. Because the script content is not pinned, authenticated beyond TLS, or integrity-checked, any compromise of the distribution source could lead to full host compromise.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | sh chaining pattern eliminates review and turns network-delivered content into immediate shell execution. This materially increases exploitability because a single manipulated response can run arbitrary commands under the user's privileges without any intermediate validation.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The header and actual behavior show this script is an environment/credential status probe, not a weather alert query tool as advertised. That mismatch increases risk because the skill may collect operational details about installed software and API key presence under false pretenses, which is especially concerning in a user-facing agent where trust depends on accurate capability declaration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script is materially inconsistent with the declared weather-alert skill: it targets a 'tencent-news-cli', probes install/update state, and checks API key configuration rather than performing a one-time weather alert lookup. In an agent skill ecosystem, this kind of capability mismatch is dangerous because it can mislead reviewers and users, expand the skill's access to local system state and credentials, and serve as a foothold for unintended data collection.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script’s behavior is materially inconsistent with the stated weather-alert skill: it probes for a different product ('tencent-news-cli'), checks install/update state, and invokes commands to inspect API key status. In a one-time weather query skill, this constitutes unnecessary local environment inspection and expands access to potentially sensitive configuration data without a clear functional need.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The wrapper for a weather-alert skill is hardcoded to execute tencent-news-cli / tencent-news-cli.exe, which is a strong indicator the skill is wired to the wrong backend tool. This can cause the agent to invoke an unintended binary from PATH, local skill directory, or install directory, leading to incorrect data access, unintended capabilities, or execution of an attacker-planted executable under a misleading skill identity.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The wrapper for a weather-alert skill resolves and executes tencent-news-cli from PATH, a user-controlled install root, or the skill directory, which is a clear mismatch with the stated purpose of the skill. This can cause the agent to invoke the wrong backend entirely, leading to unintended capabilities, data access, or execution of an attacker-planted binary if a misleadingly named CLI is present in one of the searched locations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs shell execution (sh scripts/..., PowerShell) but does not declare any explicit tool scope or allowed-tools boundary. This creates an undeclared execution surface, making it easier for an agent or reviewer to miss that the skill can run local commands and modify the environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Embedding installation, update, and credential-management capabilities in a weather lookup skill expands the privilege and trust requirements well beyond the stated function. This makes the skill more dangerous because a seemingly harmless query tool can drive system changes and secret handling workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Although the skill claims to perform only one-off weather queries, it instructs mutation of local CLI state by updating the CLI and setting or clearing API keys. Configuration-changing actions increase the blast radius beyond simple data retrieval and can affect the host environment or user credentials.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file requires every result to end with the fixed Chinese string **来源：腾讯天气**. This imposes a specific language in user-facing output even though the skill metadata is bilingual and no user opt-in or locale selection is provided.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide discloses that the installer modifies environment variables and checks API key status, but it provides no warning, consent flow, or explanation of scope. Silent system changes and credential-related checks increase risk because users may unknowingly alter shell startup files or expose sensitive configuration to an opaque script.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.