tencent-news

该技能的用途与新闻搜索基本一致，但其实际信任边界过度依赖外部黑盒 CLI。安装/更新链含远程脚本执行，且用户 API Key 被直接交给不可充分验证的 CLI，触发高风险凭证转交与供应链问题。整体更像高风险易受滥用的技能，而非已确认恶意。

This module primarily performs a common-but-high-impact workflow: download a platform-specific CLI, verify it via SHA-256 against a checksum listing, install it, and execute it to retrieve version/API-key state. There are no strong indicators of overt malware in the snippet (no eval/dynamic execution, no exfiltration, no obfuscated payloads). However, because it downloads and executes binaries from network URLs and relies on checksumUrl fetched at runtime without visible signature/authentication, the primary risk is supply-chain compromise of the download and/or checksum sources. If checksumUrl is trusted/verified out-of-band (not shown), risk decreases.

This file is an orchestrator for a supply-chain-sensitive workflow: it may download and install a platform-specific CLI binary, then execute it to obtain version information. The snippet itself contains no explicit malicious logic (no obfuscation, no credentials, no direct exfiltration), but its core impact is high and delegated to imported helpers for download integrity and safe installation. Raw CLI output is logged, which can increase information-disclosure risk in logs.