腾讯天气预警

• Outcome: Review
• Latest audit: Aug 31, 2026 · 7:45 AM UTC
• Version: 2.0.0

Overview

The skill is weather-related, but it asks users and agents to trust a broad external Tencent News CLI, install or update it through direct remote script execution, and handle API-key setup paths that need careful review.

Review before installing. Only use this skill if you are comfortable installing and updating tencent-news-cli from Tencent's remote installer, storing a Tencent News API key locally, and allowing the agent to run that CLI. Do not paste a real API key into chat; configure it directly in your terminal. Prefer a version that uses signed or checksum-verified installers and an allowlisted weather-only command wrapper.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The skill is presented as a simple one-off weather alert lookup, but its behavior includes environment inspection, update handling, API-key state management, and generic CLI command execution through a wrapper. That broader operational scope expands the trust boundary and may cause users or the platform to permit actions they would not expect from a weather-only skill, increasing the chance of unsafe command use or sensitive-state handling.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The instructions tell the agent to participate in setting and clearing the user's API key, which exceeds a one-off query tool and creates an in-session credential-handling path. Even though the text says not to record the real key, guiding users to provide or use secrets through the agent increases the risk of accidental disclosure, logging, or misuse.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The file is supposed to support a weather-alert skill, but it instead instructs users to configure a different product, `tencent-news-cli`, including obtaining and storing an API key for that unrelated service. This kind of cross-skill documentation can cause operators or downstream agents to provision the wrong credentials, misroute secrets, and make incorrect tool calls, creating a real security and integrity risk even though it does not itself contain executable malware.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The content describes retrieval, validation, and clearing of a news API key that is unrelated to the stated weather-alert functionality. In skill ecosystems, unrelated credential instructions are dangerous because they can induce users to expose or manage secrets for the wrong service, confuse authorization failures, and normalize secret-handling flows that do not belong to this skill.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The installation guide is mismatched with the declared skill identity: it documents and installs `tencent-news-cli` for a weather-alert skill. This can cause users to install the wrong software, and in a security review context such identity mismatch is a strong supply-chain red flag because it may indicate copy-paste errors, repackaging, or deliberate misdirection about what code is being installed.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The update guide is for `tencent-news-cli`, which does not match the declared weather-alert skill. This kind of artifact/identity mismatch can mislead users into installing or updating the wrong software, and in a security-sensitive setting it can indicate supply-chain confusion, repackaging, or accidental cross-linking to unrelated binaries and scripts.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation repeatedly identifies the product as `tencent-news-cli`, directly contradicting the skill's stated weather-alert identity. Such contradictory naming undermines provenance and trust, and can cause users or operators to fetch, run, or grant trust to the wrong component.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script is materially inconsistent with the declared skill purpose: instead of performing a one-time weather alert query, it discovers and executes a different binary (`tencent-news-cli`), checks installation/update state, and probes API key configuration. This creates a supply-chain and scope-confusion risk because an agent or reviewer expecting a weather tool could unknowingly run unrelated code and expose operational metadata about installed software and credential presence.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The header comments advertise install/version/API-key-state inspection rather than weather-alert querying, reinforcing that the file's behavior does not match the skill metadata. While comments alone do not execute, this mismatch is dangerous in an agent-skill ecosystem because it signals repurposed or mislabeled functionality that can mislead operators and reduce scrutiny of unrelated command execution and credential-state checks.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This script's behavior is materially inconsistent with the declared weather-alert skill: instead of performing a one-off weather query, it enumerates a local Tencent News CLI installation, executes that binary, checks update state, and inspects API-key configuration. In a skill ecosystem, this is dangerous because it expands access to unrelated local state and secrets, creating unnecessary exposure of environment details and credential presence to a component whose stated purpose does not justify it.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script invokes `apikey-get` on a local CLI and parses the returned API key output, which means the skill is probing for credential material or at minimum credential presence unrelated to weather alerts. Even though it only reports presence in JSON, executing a credential-retrieval command and handling its output creates an unjustified secret-access path that could be repurposed or leak through logs, errors, or future modifications.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs local reconnaissance by detecting OS/architecture, searching command paths and install directories, chmod'ing and executing a discovered binary, and extracting update information. For a one-off weather-alert skill, this is unnecessary host inspection that increases attack surface and can disclose environment details useful for profiling the system or chaining with other malicious behavior.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The wrapper for a weather-alert skill is hardcoded to execute `tencent-news-cli`/`tencent-news-cli.exe`, and even uses `TENCENT_NEWS_INSTALL`, which is a strong indicator of skill/CLI mismatch. In an agent setting, this can silently route user requests to an unintended binary if a news CLI is installed or planted, causing unauthorized command execution under the wrong trust boundary and potentially exfiltrating user queries or returning unrelated data.

Intent-Code Divergence

Medium

• Confidence: 86% confidence
• Finding: The inline documentation states the script executes a news CLI, directly contradicting the skill metadata that describes a weather-alert tool. This kind of misleading documentation increases the risk that reviewers and operators miss the binary mismatch, allowing the wrong executable to persist unnoticed in production.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The wrapper for a weather-alert skill invokes `tencent-news-cli` throughout, including binary name, install paths, and comments, which creates a clear skill/CLI identity mismatch. In an agent setting, this can route user weather queries into an unrelated executable with different capabilities, data access, or network behavior, causing unintended command execution, data disclosure, or confused-deputy behavior if the news CLI is more privileged or compromised.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The inline comment states that the script executes `tencent-news-cli`, directly contradicting the stated weather-alert skill purpose and reinforcing that the wrapper may be wired to the wrong tool. While a comment alone is not executable, here it corroborates the real implementation mismatch and increases the likelihood of operator confusion, missed review issues, and accidental deployment of the wrong backend for this skill.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The guide instructs users to execute remote content directly with `curl ... | sh` and `irm ... | iex`, which gives network-delivered code immediate execution without prior inspection or strong integrity verification by the user. If the CDN path, hosting account, upstream build pipeline, or DNS/TLS trust chain is compromised, users can be silently infected with arbitrary code execution on their machines.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide tells users to execute remote scripts directly via `curl ... | sh` and `irm ... | iex`, which gives a network-delivered script immediate execution with no integrity verification, review step, or authenticity check. In the context of an already mismatched product identity, this becomes more dangerous because users may run installer code for an entirely different tool while assuming it belongs to the weather skill.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly creates a natural-language workflow where a user may provide an API key and the agent may use CLI commands to set and verify it. That is dangerous because secrets can be exposed in chat history, telemetry, terminal logs, or error output, especially in a skill that otherwise appears to be a simple weather lookup.

External Script Fetching

High

• Category: Supply Chain

Content

用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引：

- **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。
- **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。
- **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。
- **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。

• Confidence: 98% confidence
• Finding: The skill instructs users to install software via a remote script piped directly into a shell or PowerShell interpreter. This pattern is dangerous because it executes network-fetched code without inspection or integrity verification, so a compromised host, CDN, or delivery path could result in arbitrary code execution on the user's machine.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.