Security audit

tencent-weather

Security checks across malware telemetry and agentic risk

Overview

This weather skill is coherent enough not to be malicious, but it needs review because it uses unverified remote installers, local CLI execution, and API-key handling for a broader Tencent News CLI.

Review before installing. Use this only if you trust the Tencent News CLI installer source and are comfortable with a skill that can install or update a local CLI and configure an API key. Prefer downloading and verifying installers manually rather than piping remote scripts directly into a shell, and do not share real API keys with the agent.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill clearly instructs the agent to execute shell scripts (`cli-state.sh`, `run-cli.sh`) and other shell-based setup flows, yet no permissions are declared. This creates a capability/consent gap: users and the hosting platform may not realize the skill can invoke local shell commands, install software, or mutate local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The public description presents this as a simple weather lookup skill, but the instructions include environment inspection, version checks, API-key management, software installation/update flows, and execution of arbitrary Tencent CLI subcommands via a wrapper. This mismatch is security-relevant because it can mislead users into approving a skill that has substantially broader local execution and configuration capabilities than advertised.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The setup guide is for `tencent-news-cli` and references a news API key flow, while the analyzed skill is `tencent-weather`. This mismatch can cause users or downstream agents to configure the wrong tool, mishandle credentials, or apply incorrect operational steps, which is a real security and integrity issue because it can lead to accidental secret exposure or unintended access configuration.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The installation guide is for 'tencent-news-cli' while the declared skill is Tencent Weather, which is a serious supply-chain red flag. This mismatch can mislead users into installing unrelated software and suggests the package contents may be confused, swapped, or intentionally repurposed, increasing the chance of unauthorized code execution or credential exposure.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The file is for a weather skill but the update guide documents a different product, `tencent-news-cli`, including installation/update behavior. This mismatch is a supply-chain red flag because unrelated operational instructions can mislead users into installing or updating unintended software, and it indicates poor package integrity or possible content substitution.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documentation instructs users to execute remote scripts directly from the network via `curl | sh` and `irm ... | iex`, which enables arbitrary code execution with no integrity verification. In the context of a weather query skill, this capability is unjustified and broadens the trust boundary from passive data retrieval to full host compromise if the endpoint, CDN, or content is tampered with.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script for a weather skill is wired to detect and interrogate a different product, `tencent-news-cli`, including install paths and command resolution. This creates a strong capability mismatch: instead of supporting weather queries, the skill interacts with unrelated local executables, which can cause unauthorized execution of a substituted binary on the user's system and misleading behavior inconsistent with the declared skill purpose.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The file advertises and implements install-state, update-state, and API-key-state inspection rather than weather retrieval. In a weather skill context, this is dangerous because it expands scope into local environment reconnaissance and secret-state probing, which is unnecessary for the user-facing function and can be abused to collect sensitive operational information.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The script’s behavior is materially inconsistent with the declared skill purpose: instead of weather lookup, it locates and interrogates a Tencent News CLI installation. In an agent-skill context, this kind of scope drift is dangerous because it can cause the agent to inspect local binaries and environment-dependent state unrelated to the user’s request, expanding access to local system information without clear justification.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This section performs version/update checks and API-key state inspection for a local CLI rather than serving weather data. In a skill ecosystem, hidden credential/state discovery is security-relevant because it can enumerate installed tools, probe configuration, and reveal whether secrets are present, all of which exceeds the least-privilege expectations created by the weather-skill description.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The wrapper for a weather skill is hardcoded to locate and execute `tencent-news-cli`/`tencent-news-cli.exe`, including a news-specific install path and environment variable. This creates a clear capability mismatch: a user invoking a weather tool may actually trigger an unrelated binary present on PATH or in the expected install locations, enabling unintended data access or execution of the wrong privileged component. In the skill context, this is more dangerous because users and higher-level agents will trust the skill metadata and may supply weather queries to a script that dispatches to a different product entirely.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The inline documentation explicitly states that the script executes `tencent-news-cli`, which contradicts the declared purpose of the skill as a weather query tool. While comments alone do not execute, here they accurately reflect the hardcoded runtime behavior and indicate a likely copy/paste integration error that can mislead reviewers and operators, reducing the chance the mismatch is caught before deployment.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The wrapper for a weather skill is hardcoded to locate and execute `tencent-news-cli`, with install paths and environment variables also namespaced for the news CLI. This mismatch can cause the skill to invoke an unintended binary if that CLI is present, leading to capability confusion and potentially exposing users to the behavior of a different tool than the one described by the skill.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The inline comment explicitly states the script executes `tencent-news-cli`, which contradicts the weather skill metadata and reinforces that the wrapper may have been copied from another skill without being correctly adapted. While comments alone do not execute, here they corroborate the operational mismatch in the code and increase confidence that the wrong binary is intentionally or accidentally being run.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The command downloads a remote shell script and pipes it directly into 'sh', causing unreviewed code from the network to execute immediately on the user's machine. If the CDN content, DNS, TLS termination, or upstream publishing pipeline is compromised, attackers can run arbitrary commands with the user's privileges.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The PowerShell instruction uses 'irm ... | iex' to fetch and immediately execute remote code without validation or user review. This creates the same arbitrary code execution risk on Windows and is especially dangerous because PowerShell is commonly targeted for post-exploitation and environment persistence.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The troubleshooting section tells users to bypass macOS Gatekeeper and Windows SmartScreen protections without explaining the security implications or requiring independent verification of the downloaded software. These prompts exist to warn about untrusted or unsigned code, so normalizing bypass behavior increases the likelihood that users will run malicious binaries.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: Piping downloaded content straight into a shell or PowerShell interpreter executes whatever the remote server returns without review, sandboxing, or authenticity checks. The lack of warnings or verification guidance increases the chance that users will run malicious or modified code, leading to system takeover, credential theft, or persistence.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script actively invokes `apikey-get` and parses whether an API key is configured without any explicit disclosure, consent, or minimization controls. Even though it does not print the full secret, checking secret presence through a local CLI is still secret-state access and can expose sensitive environment details or trigger execution of an attacker-controlled replacement binary found via command resolution.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script invokes `apikey-get` and parses the returned API key value, which means it actively retrieves secret material rather than merely checking configuration status. Even though the final JSON only reports presence, pulling the secret into process output and shell variables unnecessarily increases exposure through logs, error handling, subprocess visibility, or future code changes.

External Script Fetching

High

Category: Supply Chain
Content: 用户直接提出业务问题时，也必须先检查环境。CLI 或 API Key 未就绪时，当前轮停止业务查询，不得只回复“数据加载失败”、原始错误或泛化的“请检查配置”，必须给出可直接操作的指引： - **CLI 未安装/不可用**（`cliExists: false`、`cliSource: none`、`cli not found`、`command not found`、`not recognized`）：说明本查询依赖腾讯新闻 CLI，当前设备尚未安装或未被识别；按平台提供安装命令：macOS/Linux 使用 `curl -fsSL https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.sh | sh`；Windows PowerShell 使用 `irm https://mat1.gtimg.com/qqcdn/qqnews/cli/hub/tencent-news/setup.ps1 | iex`。提醒安装后重新打开终端并重新提问。 - **API Key 未配置**（`apiKey.status: missing`、`未设置 API Key`、`API Key not set`）：说明 CLI 已安装但尚未配置 Key；引导访问 `https://news.qq.com/exchange?scene=appkey` 获取，然后执行 `tencent-news-cli apikey-set YOUR_KEY`，再执行 `tencent-news-cli apikey-get` 验证。 - **API Key 无效、过期或无权限**（`API Key 无效`、`invalid api key`、`unauthorized`、`401`、`403`、鉴权/认证失败）：不得归因为无数据、额度或普通网络错误；说明当前 Key 无效或无权访问，引导从上述页面重新获取正确 Key，再执行设置和验证命令。 - **状态不确定**（状态脚本失败、`apiKey.status: error` 或无法解析）：先按错误文本匹配以上类型；仍无法判断时，同时给出安装命令及 Key 获取、设置、验证步骤。
Confidence: 97% confidence
Finding: The skill instructs users to install software by piping a remotely fetched script directly into a shell (`curl ... | sh`) and likewise `iex` on PowerShell. This is dangerous because any compromise of the remote host, CDN path, DNS/TLS trust chain, or script publisher would lead to immediate arbitrary code execution on the user's machine without an opportunity to inspect the script first.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.