T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:12- Finding
Unauthenticated remote update response can inject instructions into the agent session
- Content
View full analysis
- Remediation
View remediation
Security audit
Tencent Drive(Weiyun) MCP
Security checks for vulnerabilities and agentic risk
Overview
This skill is for Weiyun cloud-file management, but it gives agents unsafe update, credential, upload, and setup-script authority that users should review before installing.
Install only if you trust the Weiyun publisher and are comfortable giving the agent access to manage cloud files. Before use, avoid putting tokens on command lines, verify any setup script path yourself, do not follow remote update instructions automatically, and only upload, delete, or share files after explicit confirmation of the exact targets and destination.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/upload_to_weiyun.py:406- Finding
Caller-controlled MCP endpoint receives the authentication token and complete file contents
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
references/auth.md:5- Finding
Authentication workflow executes missing relative setup scripts from the current working directory
- Content
View full analysis
``` Neither `setup.sh` nor `setup.ps1` exists in the supplied project directory structure. ### Technical Analysis The authentication guide instructs the agent to execute scripts using paths relative to the process's current working directory rather than paths resolved relative to the installed Skill directory. Because the referenced files are absent from the audited package, the commands either fail or execute a same-named file supplied by some other directory. This creates a local tool-spoofing boundary: the command looks like an official Skill setup action, but its actual implementation is not part of the reviewed artifact. On Windows, `-ExecutionPolicy Bypass` explicitly suppresses the normal PowerShell execution-policy check for the selected file. It does not itself grant administrator privileges, but it makes an attacker-supplied `setup.ps1` easier to execute under the agent's existing account. The fetch and set-token operations are especially sensitive because a spoofed script can access command-line token values, local MCP configuration, environment variables, and other files accessible to the invoking process. ### Attack Path 1. The Skill is invoked while the agent's current directory is writable or controlled by an attacker, such as an extracte ...[truncated 1492 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:383- Finding
Documentation encourages passing the MCP token through command-line arguments and the script emits token fragments
- Content
View full analysis
\ --env_id ``` The script accepts the same command-line option at `scripts/upload_to_weiyun.py`, lines 390-391: ```python parser.add_argument( "--token", default=None, help="MCP token" ) ``` It then prints a portion of the token at lines 420-425: ```python print(f"=" * 60) print(f"Weiyun upload: {args.file_path}") print(f"MCP URL: {mcp_url}") print(f"Token: {mcp_token[:8]}...{mcp_token[-4:]}") ``` ### Technical Analysis Command-line arguments are commonly exposed to resources beyond the intended process, including: - Shell history files. - Process-listing tools. - Job runners and orchestration metadata. - Terminal capture and support transcripts. - Agent execution logs. - Crash reports or command auditing facilities. The documentation presents `--token` as a normal usage pattern, making accidental persistence likely. Although the script masks the middle of the token when printing, it still discloses the first eight and last four characters. Partial disclosure can assist token correlation, incident tracking by an attacker, or validation of tokens acquired through another channel. Environment variables are also not ideal long-term secret storage, but they generally avoid shell-history and process-argument exposure. A protected credential store or restricted configuration file is preferable. ### Attack Path 1. A user follows the documented example and places a valid MCP token after `--token`. 2. The shell records the command in its history, or an automation platform records the full command line. 3. Another local user, support operator, c ...[truncated 893 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)
Tainted flow: 'mcp_url' from os.environ.get (line 406, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 94% confidence
- Finding
The script allows the MCP endpoint to be supplied from an environment variable or CLI argument and then sends the MCP token in the WyHeader to that URL without validation. If an attacker can influence WEIYUN_MCP_URL or the provided --mcp_url, they can redirect uploads and credentials to an attacker-controlled server, causing token exfiltration and unauthorized file disclosure.
- Content
python "method": "tools/call", "params": {"name": tool_name, "arguments": arguments}, } resp = requests.post(mcp_url, headers=headers, json=payload, timeout=120) resp.raise_for_status() result = resp.json() content = result.get("result", {}).get("content", [])
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose describes a full-featured Weiyun/MCP integration with many concrete tools and upload-related logic. The actual code chunk is only a minimal placeholder comment for an encoding fix module and provides none of the described functionality. This is not a case of partial implementation detail; the primary purpose is materially different and the advertised capabilities are unsupported by the provided code.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool scope or permissions boundaries, yet its instructions direct the agent to use network access, shell commands, Python execution, and environment variables. This weakens least-privilege guarantees and increases the chance that an agent will perform sensitive local or outbound actions beyond what a user expects from a documentation-oriented skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs callers to include reporting data in req_header but does not present a clear privacy warning or consent flow to the user. Silent telemetry collection is dangerous because users may not realize that environment metadata is being sent to a third party whenever they use ordinary file-management functions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill requires use of real Weiyun cookies together with MCP tokens, but it does not provide strong warnings or controls for handling these credentials safely. Combining session cookies and tokens raises the risk of credential leakage through logs, shell history, copied commands, or agent memory, which could enable unauthorized access to a user's cloud files.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs agents to execute local shell/Python commands and consume environment variables to perform uploads and related operations. That expands the trust boundary from MCP guidance into arbitrary local execution, creating risk of command misuse, accidental execution in the wrong environment, exposure of secrets in env vars, and unauthorized file access on the host.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill mandates collection and transmission of host OS details and client version telemetry in req_header for every request. Even if intended for troubleshooting, this collects device-identifying information beyond the core file-management task and can expose user environment metadata without necessity or informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manual fallback instructs the operator to persist a raw micro-cloud access token into local mcporter configuration via command line, but it does not clearly warn that this stores a reusable credential on disk. That creates a realistic risk of unintended credential exposure through shell history, local config leakage, backups, multi-user machines, or support log sharing, especially because the token appears sufficient to access the user's Weiyun MCP endpoint.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。 ### 请求（McpListReq） | 字段 | 类型 | 必填 | 说明 | |------|------|------|------|
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。 ### 请求（McpListReq） | 字段 | 类型 | 必填 | 说明 | |------|------|------|------|
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。 ### 请求（McpListReq） | 字段 | 类型 | 必填 | 说明 | |------|------|------|------|
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 查询微云网盘的目录内容，支持按目录查看文件和子目录，支持分页和排序。 ### 请求（McpListReq） | 字段 | 类型 | 必填 | 说明 | |------|------|------|------|
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document states that real Weiyun cookies such as
uidanduid_keyare required, but does not include handling guidance for these credentials. That is risky because an agent or integrator may log, echo, persist, or mishandle live session secrets, enabling account access if exposed.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document exposes a destructive deletion capability, including permanent deletion, but does not state that agents must obtain explicit user confirmation before invoking it. In an agent-skill context, that omission is dangerous because a model may treat deletion as a routine file-management step and irreversibly remove user data without a clear consent checkpoint.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The share-link tool allows creation of public or passwordless links, but the documentation does not warn that this may expose private files to anyone with the URL. In a skill used by an autonomous or semi-autonomous agent, the lack of privacy guidance increases the chance that sensitive user content is shared externally without informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document instructs the agent/client to upload file contents, hashes, and metadata to a remote service, but it does not include any user-facing warning, consent step, or privacy notice. In an agent skill context, this increases the risk of unintended exfiltration of sensitive local data because the instructions normalize transmission without requiring confirmation or clarifying what leaves the user environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The usage examples explicitly recommend passing the MCP token on the command line, which commonly exposes secrets through shell history, process listings, audit logs, and terminal recordings. This is especially risky for a cloud storage token because it may grant file access or destructive operations if later recovered by another local user or monitoring system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python "method": "tools/call", "params": {"name": tool_name, "arguments": arguments}, } resp = requests.post(mcp_url, headers=headers, json=payload, timeout=120) resp.raise_for_status() result = resp.json() content = result.get("result", {}).get("content", [])
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
A language-policy issue can arise when a skill effectively forces one language without user opt-in. This file's headings, instructions, and usage guidance are entirely in Chinese, and there is no indication that the skill is region-specific or that users may choose another language.
- Content
Static analysis
No suspicious patterns detected.