Security audit

tencent-weather

Security checks for vulnerabilities and agentic risk

Overview

This weather skill may work through Tencent's news CLI, but it asks users or agents to install and run mutable remote scripts with no verification and weak product-boundary clarity.

Install only if you are comfortable trusting Tencent's news CLI installer and API-key flow for local execution. Prefer a versioned, signed installer or checksum-verified download instead of running the provided curl|sh or irm|iex commands, and review exactly which binary is being installed before giving it an API key.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:37
Finding: Unverified Remote Installer Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a weather tool but relies on executing a general CLI, reading local metadata, and performing process/version discovery unrelated to direct weather retrieval. That broader operational behavior expands the trust boundary and may expose the host environment to command execution and local-information access not implied by the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill presents itself as a weather tool but relies on executing a general CLI, reading local metadata, and performing process/version discovery unrelated to direct weather retrieval. That broader operational behavior expands the trust boundary and may expose the host environment to command execution and local-information access not implied by the description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
md
| macOS / Linux | `sh scripts/run-cli.sh <command> [args]` |

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill instructs users to install software via curl ... | sh and irm ... | iex, which executes remote, mutable script content directly in the shell without prior verification. If the hosting endpoint, transport chain, or distributed installer is compromised, this becomes an immediate arbitrary code execution path on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The installation guide is for tencent-news-cli while the declared skill is Tencent Weather, which is a strong supply-chain integrity problem. This mismatch can mislead users into installing or trusting the wrong software, and in the context of an agent skill it increases the risk that unrelated or unauthorized code is distributed under a different identity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation repeatedly identifies the component as tencent-news-cli, directly contradicting the stated weather-skill identity. Such identity inconsistency is dangerous because it breaks user trust and creates an opportunity for substitution of unintended software, especially when paired with one-line install commands.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Fetching a script from an external URL and executing it as part of installation creates a direct remote-code-execution path. In this file, the risk is amplified by the product-identity mismatch, because users may execute code for an entirely different component than the declared weather skill.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | sh pattern chains uninspected network data directly into a shell, removing any opportunity for review and making tampering immediately exploitable. If the upstream content changes or is compromised, arbitrary commands will run with the user's privileges at install time.
Content: Scanner excerpt · references/installation-guide.md (reported line 8)May include surrounding context.
打开终端，执行以下命令：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

脚本会自动完成：识别系统和架构 → 下载 CLI → 验证 → 配置环境变量 → 检测 API Key 状态。

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl ... | sh fetches code from the network and immediately executes it in the shell, eliminating any opportunity for integrity verification or human review. If the remote content, CDN path, DNS, or publishing pipeline is compromised, arbitrary code execution occurs on the user's machine with the user's privileges.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The shell pipe into sh is a dangerous command chain because it turns retrieved text into executable code without validation. In the context of a weather skill, this is more suspicious because the file already references a different CLI product, increasing the risk that users are being steered toward unrelated or unintended code execution.
Content: Scanner excerpt · references/update-guide.md (reported line 20)May include surrounding context.
macOS / Linux：

sh
curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh

Windows：

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The weather skill’s state script is wired to a different product entirely: it probes for tencent-news-cli, uses TENCENT_NEWS_INSTALL, and inspects News CLI install paths. In a security-sensitive agent context, this creates cross-skill confusion and can cause the weather skill to execute an unrelated binary found on PATH or in a news-specific install directory, exposing metadata about the wrong tool and potentially invoking attacker-controlled binaries if the environment is manipulated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script is for a weather skill, but it is wired to detect and operate on a different product name, tencent-news-cli, including install roots and binary names. This indicates either copy-paste reuse or package confusion, which can cause the skill to invoke or disclose state from an unrelated CLI installed on the host, violating least surprise and potentially exposing unrelated credentials or metadata.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Instead of implementing weather-query behavior, the script enumerates local installation status, version/update state, and API key presence by executing a discovered CLI and parsing its output. In the context of a weather skill, this is out-of-scope host reconnaissance and secret-state probing; if triggered by an agent, it could leak sensitive environment details and interact with unrelated local software.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The wrapper for a weather skill is hardcoded to locate and execute tencent-news-cli/tencent-news-cli.exe, and even uses TENCENT_NEWS_INSTALL plus a .tencent-news-cli install root. This is a strong skill-deception/integrity issue: users invoking a weather tool may unknowingly execute an unrelated binary, enabling unintended data access, command behavior, or abuse under the trusted context of the weather skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The weather skill wrapper resolves and executes a binary named tencent-news-cli from PATH, a user-controlled install root, or the skill directory, rather than a weather-specific tool. This creates a clear trust-boundary violation and functionality mismatch: invoking an unrelated CLI can expose users to unintended data access, wrong backend actions, or execution of an attacker-planted binary if PATH or the install location is manipulated.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to execute shell-based scripts (cli-state.sh, run-cli.sh) but does not declare any explicit tool scope or allowed-tools boundary. That weakens policy enforcement and transparency, making it easier for a seemingly simple weather skill to invoke local command execution capabilities that users and reviewers may not expect.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file consistently instructs the agent in Chinese and provides a fixed Chinese output template, including the required footer 来源：腾讯天气, but does not offer any language/locale opt-in or choice. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless clearly justified as region-specific; here the tool covers Chinese locations, but the instructions do not state that responses must be Chinese for compliance or other documented necessity.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is part of the tencent-weather skill but contains setup instructions for a different tool, tencent-news-cli, including obtaining and configuring an API key from a news-related endpoint. This mismatch can misdirect users into installing or configuring the wrong CLI, disclosing credentials to the wrong component, or causing the agent to operate outside its documented scope, which is a real security and integrity issue even if it appears accidental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guide instructs users to execute remote scripts directly from the network on both Unix and Windows without an explicit warning or independent verification step. This is dangerous because any compromise of the hosting path, CDN, or delivery chain can immediately lead to arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is for a weather skill, but the update guide documents a different product ('tencent-news-cli') and points users to install/update scripts for that unrelated CLI. This supply-chain/identity mismatch can mislead users into installing unintended software, and in a security review it is a strong indicator of copy-paste error, repository contamination, or possible deceptive redirection.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.