TencentAds-miaowen-qa

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:19 PM UTC
• Version: 1.0.2

Overview

The skill appears to do Tencent Ads Q&A as described, but it asks users to hand an API token to the agent and stores it locally in a risky way.

Review this before installing. The main risk is credential exposure: do not paste a real Miaowen API token into an AI chat or run commands that place the token directly on the command line unless you accept that it may appear in logs, history, or process metadata. Prefer setting the token locally through a safer secret-entry method, use a least-privilege or revocable token, and avoid sending confidential business data in questions because queries are sent to Tencent's API.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_token.sh:9
• Finding: API Token Exposed Through Chat and Command-Line Arguments## Vulnerability Details **File Location**: `scripts/setup_token.sh:9-29`; related workflow instructions at `SKILL.md:134-152` and `scripts/chat.sh:99,116` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code `scripts/setup_token.sh:9-29`: ```bash set -euo pipefail TOKEN="${1:-}" # Check HOME directory if [ -z "${HOME:-}" ]; then echo "[ERROR] Unable to determine the user's HOME directory." exit 1 fi TOKEN_FILE="${HOME}/.MIAOWEN_ACCESS_TOKEN" if [ -z "$TOKEN" ]; then echo "[ERROR] Please provide a Token argument" echo "Usage: bash setup_token.sh \"<YOUR_TOKEN>\"" exit 1 fi # Write the Token to the file, replacing any existing value echo -n "$TOKEN" > "$TOKEN_FILE" ``` `SKILL.md:134-152`: ```markdown > 5. Paste the copied Token to me ... > After obtaining the Token, paste it to me, and I will automatically save it to the configuration file. When the user provides a Token, use the `scripts/setup_token.sh` script to save it: ```bash bash scripts/setup_token.sh "<TOKEN_VALUE>" ``` ``` `scripts/chat.sh:99` and `scripts/chat.sh:116`: ```bash echo "After obtaining the Token, paste it to me, and I will automatically save it." ``` ```bash echo "After obtaining the Token, paste it to me, and I will save it again." ``` ### Technical Analysis The documented workflow asks the user to disclose an API credential directly in an AI conversation. The agent is then instructed to place that credential in the first positional argument of `setup_token.sh`. Secrets passed this way may be retained in conversation history, agent execution telemetry, audit logs, or tool-call records. Command-line arguments can also be exposed through process-inspection facilities while the process is running. Depending on the operating system and its process-access restrictions, they may be visible to the same user, admi ...[truncated 1747 chars]
• Remediation: ## Remediation Suggestions 1. Do not ask users to paste API tokens into an AI conversation. Direct users to configure the credential through a trusted local terminal or dedicated secret-management interface. 2. Remove positional-argument token handling from `setup_token.sh`. Read the secret silently from an interactive terminal, for example with `IFS= read -rs TOKEN`, or accept it through a protected file descriptor or standard input when automation is necessary. 3. Do not include token values in tool-call parameters, command logs, diagnostic output, or error messages. Apply explicit secret redaction to agent and execution telemetry. 4. Create the token file with restrictive permissions from the outset rather than tightening permissions only after writing: ```bash umask 077 TOKEN_FILE="${HOME}/.MIAOWEN_ACCESS_TOKEN" IFS= read -rs -p "Miaowen API token: " TOKEN printf '\n' printf '%s' "$TOKEN" > "$TOKEN_FILE" chmod 600 "$TOKEN_FILE" unset TOKEN ``` 5. Update `SKILL.md` and `chat.sh` so they never direct users to submit credentials through chat or command-line arguments. 6. Advise users who followed the previous workflow to rotate their token and remove any exposed value from conversation records, shell history, and retained execution logs where possible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is Tencent Ads Q&A, but the documented behavior includes collecting a credential from the user, persisting it under the user's home directory, and changing file permissions. This mismatch is dangerous because it hides sensitive local actions behind a benign knowledge-assistant description, reducing informed consent and making social-engineering abuse easier.

Credential Access

High

• Category: Privilege Escalation

Content

当用户需要获取 Token 时（首次使用、Token 为空或已过期），向用户展示以下指引：

> 🔑 您需要先获取妙问 API KEY（Access Token）才能使用 AI 问答服务。
>
> **获取步骤**：
> 1. 打开 [妙问官网](https://miaowen.qq.com/) 并登录

• Confidence: 91% confidence
• Finding: This finding is substantiated by the workflow that guides the user to retrieve an Access Token and provide it to the assistant for subsequent storage and use. In this context, the skill is facilitating credential collection and use, which is sensitive because the token likely grants API access tied to the user's account and can be abused if exposed.

External Script Fetching

High

• Category: Supply Chain

Content

echo "  Arch Linux:        sudo pacman -S curl"
            ;;
        MINGW*|MSYS*|CYGWIN*)
            echo "  Windows Git Bash:  curl 通常随 Git for Windows 自带，请尝试重新安装 Git for Windows"
            echo "  Windows Scoop:     scoop install curl"
            echo "  Windows Chocolatey: choco install curl"
            ;;

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

echo "  Arch Linux:        sudo pacman -S curl"
            ;;
        MINGW*|MSYS*|CYGWIN*)
            echo "  Windows Git Bash:  curl 通常随 Git for Windows 自带,请尝试重新安装 Git for Windows"
            echo "  Windows Scoop:     scoop install curl"
            echo "  Windows Chocolatey: choco install curl"
            ;;

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The script explicitly instructs users to paste an API token into chat, encouraging disclosure of a secret in plain language. In agent or chat-integrated environments, this can leak credentials into conversation history, telemetry, audit logs, or third-party systems, enabling unauthorized API use.

Ssd 3

High

• Confidence: 99% confidence
• Finding: This second prompt repeats the unsafe request to paste a refreshed token into chat, reinforcing insecure secret-handling behavior. A refreshed token is just as sensitive as the original and could be abused immediately if exposed.

Credential Access

High

• Category: Privilege Escalation

Content

#!/usr/bin/env bash
#
# setup_token.sh — 将妙问 Access Token 保存到文件
#
# 用法: bash setup_token.sh "<YOUR_TOKEN>"
#

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the agent to execute shell scripts, but the manifest does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization and review gap: a user or platform may believe this is a documentation-only skill while it actually performs code execution and local state changes.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: L055 明确写明当用户问题不够明确时“不要直接调用 API”，需要先追问补齐关键信息；但 L074-L080 又指示触发技能时“直接执行 scripts/chat.sh 脚本，无需提前检查任何内容”。这两段操作说明在是否应先判断问题明确性上形成直接矛盾，属于文档意图与执行指令相互冲突。

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the assistant to ask the user to paste an API token into the conversation and then save it locally, without a strong warning that this is a sensitive credential. Asking users to transmit secrets through the assistant increases the risk of accidental disclosure in chat history, logs, telemetry, screenshots, or model/provider retention systems.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The script's human-facing description and usage are entirely in Chinese, including the expected question format, with no indication that other languages are supported or that Chinese is a deliberate region-specific requirement. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

case "$OS_TYPE" in
        Darwin*)
            echo "  macOS (Homebrew):  brew install curl"
            echo "  macOS (MacPorts):  sudo port install curl"
            ;;
        Linux*)
            echo "  Ubuntu/Debian:     sudo apt-get install -y curl"

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "  Arch Linux:        sudo pacman -S curl"
            ;;
        MINGW*|MSYS*|CYGWIN*)
            echo "  Windows Git Bash:  curl 通常随 Git for Windows 自带，请尝试重新安装 Git for Windows"
            echo "  Windows Scoop:     scoop install curl"
            echo "  Windows Chocolatey: choco install curl"
            ;;

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The script tells the user to paste their token into chat so it can be 'automatically saved,' but this script contains no token-saving logic. That guidance trains users to disclose a live secret through a chat channel, which could expose credentials to logs, other tools, or operators unrelated to the local shell script.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script reads an access token from disk and transmits the user's question to a remote Tencent endpoint, but it provides no runtime privacy notice warning users not to include sensitive data in their queries. In a chat-assistant context, users may reasonably paste account details, campaign data, or other confidential business information, which would then be sent off-host automatically.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: This repeated message again asks the user to paste a refreshed token for saving, despite the script lacking any code to store it. Repetition increases the chance of credential disclosure and normalizes sending secrets through an unsafe conversational channel.

External Transmission

Medium

• Category: Data Exfiltration

Content

fi

# 发起请求（设置 3 分钟超时）
RESPONSE=$(curl -s -w "\n%{http_code}" --connect-timeout 10 --max-time 180 -X POST \
    -H "Authorization:Bearer ${MIAOWEN_ACCESS_TOKEN}" \
    -H "Content-Type:application/json" \
    -d "{\"query\":\"${ESCAPED_QUESTION}\"}" \

• Confidence: 96% confidence
• Finding: The script sends user-supplied questions and a bearer token to an external API endpoint. That is expected for the skill's purpose, but it still creates a real data-exposure boundary: any sensitive content in queries and the credential itself are transmitted off the local system.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script requires the access token to be supplied as a positional command-line argument, which can expose the secret through shell history, process listings, audit logs, or CI job output. While the script later stores the token with restrictive permissions, the initial input path still leaks the credential before it is protected.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 设置文件权限为仅当前用户可读写（保护 Token 安全）
# 注：Windows 环境下 chmod 可能不生效，但不影响功能使用
if chmod 600 "$TOKEN_FILE" 2>/dev/null; then
    echo "[SUCCESS] Token 已成功保存到 ${TOKEN_FILE}"
    echo "  文件权限已设置为仅当前用户可读写 (600)"
else

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Low

• Confidence: 83% confidence
• Finding: The manifest frames the skill as answering Tencent Ads business questions via the official 妙问 API, but does not mention local filesystem access or credential-file handling. The code requires reading ~/.MIAOWEN_ACCESS_TOKEN from disk, which is an additional capability beyond pure question answering, even though it supports authentication.

Static analysis

No suspicious patterns detected.