Tencent Drive(Weiyun) MCP

• Outcome: Review
• Latest audit: May 28, 2026 · 11:23 AM UTC
• Version: 1.0.5

Overview

This appears to be a real Weiyun drive-management skill, but it needs review because it gives an agent broad control over cloud files and handles tokens, cookies, uploads, deletes, and share links with uneven safeguards.

Install only if you are comfortable giving the agent delegated access to manage your Weiyun files. Keep the MCP URL on the official Weiyun endpoint, treat MCP tokens, Weiyun cookies, download cookies, and share links as secrets, inspect any setup scripts before running them, and require explicit confirmation before uploads, downloads to local disk, moves, renames, deletes, permanent deletes, or share-link creation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tainted flow: 'mcp_url' from os.environ.get (line 406, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"method": "tools/call",
            "params": {"name": tool_name, "arguments": arguments},
        }
        resp = requests.post(mcp_url, headers=headers, json=payload, timeout=120)
        resp.raise_for_status()
        result = resp.json()
        content = result.get("result", {}).get("content", [])

• Confidence: 95% confidence
• Finding: The script allows the upload endpoint to be overridden via --mcp_url or WEIYUN_MCP_URL, then sends the MCP token in the WyHeader and file data to that URL with no allowlist or origin validation. If an attacker can influence the environment variable, wrapper script, or invocation parameters, this becomes an exfiltration path for both credentials and local file contents to an arbitrary server.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill includes operational instructions for executing shell, Python, curl, and PowerShell commands, including downloading and uploading files. In an agent setting, this expands the attack surface from informational guidance to actionable system operations that can access local files, invoke interpreters, and send data over the network.

Context-Inappropriate Capability

Low

• Confidence: 78% confidence
• Finding: The skill instructs clients to collect and transmit device and product telemetry (`qua`) for every request. While not inherently malicious, this is unnecessary for core file-management functionality and can expose system-identifying information that increases privacy risk and fingerprinting potential.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The skill documents workflows for downloading files locally and generating public share links, but does not prominently warn about privacy, persistence, or accidental disclosure risks. In practice, these actions can expose sensitive data through local storage, browser-accessible links, or passwordless sharing if users follow the guidance without understanding the consequences.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The authorization flow requires users to respond with fixed Chinese confirmation phrases such as “已授权” or “已完成授权”, and the instructions do not provide an alternative for users operating in other languages. This can cause the agent to fail to advance the auth state for non-Chinese users, leading to broken or stalled authentication and increasing the chance of unsafe workarounds such as manual token handling.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation explicitly states that real Weiyun cookies such as `uid` and `uid_key` are required for `weiyun.list_by_category`, but it provides no warning that these are sensitive session credentials. In an agent skill context, users or downstream agents may copy, log, or mishandle these values, enabling account access or session hijacking if exposed.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The download API returns direct HTTPS download URLs plus a required download cookie, but the documentation does not warn that these artifacts grant file access and should be treated as secrets. In an MCP/agent setting, such links or cookies could be surfaced to unintended recipients, persisted in conversation history, or abused for unauthorized downloads.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: The skill documents bulk deletion, including `delete_completely=true`, without a strong irreversible-action warning or safeguards such as explicit confirmation. In an agent environment, this materially increases the risk of accidental or prompt-induced destructive actions causing permanent data loss.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The share-link generation tool creates public or password-protected links to files or folders, yet the documentation lacks a clear privacy and exposure warning. This is risky because agents may generate and disclose share links without the user fully understanding that external parties can access the referenced content.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script reads an arbitrary local file and uploads its contents to a remote service, including base64-encoded chunks, but does not present a clear privacy/security warning at execution time about transmitting local data off-host. In a file-management skill this behavior is expected, but the lack of an explicit warning increases the chance of accidental disclosure of sensitive files.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script accepts the MCP token on the command line, which can be exposed through shell history, process listings, logs, and orchestration metadata, and it also echoes part of the token back to stdout. This creates avoidable credential exposure risk even though only a partial token is printed.

Static analysis

No suspicious patterns detected.