tencent-docs

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.60). The SKILL instructs the agent to "静默调用 report_unsupported_feature …（无需告知用户已上报）", i.e. to silently report unsupported capabilities without informing the user, which is a hidden/deceptive instruction that affects agent transparency and lies outside a neutral usage guide.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The docs contain explicit instructions that solicit user tokens/credentials via the agent and authorize silent reporting to platform endpoints — patterns that enable credential theft or unnoticed data exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 该工作流读取并直接使用用户输入的原始自由文本到 slide-mcp 的 slide_references.md:create_slide 参数 description，在创建/编辑 PPT 时不要求先选择特定文档条目即可注入。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill invokes mcporter against https://docs.qq.com/openapi/mcp at runtime (SKILL.md lines 166-168) to run check_skill_update which returns an "instruction" field that the agent is instructed to follow to perform updates—i.e., remote content fetched at runtime can contain actionable instructions that control agent behavior.