This skill is vulnerable to prompt injection, can exfiltr
Claims to do
云文件上传备份工具 (Tencent Agent Storage): 将本地文件上传至 Tecent Agent Storage,自动生成下载链接和图片预览。上传的文件存储在用户独有的云盘空间中,支持跨端访问——无论是手机、电脑还是平板,用户都可以随时随地查看和下载自己的文件。
Actually does
This skill executes a Node.js script (`/tmp/smh-upload.js`) to interact with Tencent Agent Storage. It uploads local files, retrieves file metadata, and lists directory contents by calling the `smh-node-sdk` and contacting `https://api.tencentsmh.cn`. It accesses local files, reads configuration from `~/.openclaw/openclaw.json` and `.env` for `smh_` prefixed credentials, and generates direct download URLs for uploaded files.
openclaw skills install shawnminh/tencent-agent-storageDeBERTa classifier detected prompt injection (confidence: 0.99)
The skill's `upload` command allows specifying any `localPath` on the system, which is then read and uploaded. While semantic guardrails are in place, a compromised agent could be instructed to exfiltrate sensitive files from the user's system.
node /tmp/smh-upload.js upload '{"localPath":"/path/to/file.pdf", ...}'
const absLocal = expandHome(localPath);The skill explicitly requires a `space_admin` level `accessToken` for its operations. This grants broad permissions on the Tencent Agent Storage, increasing the blast radius if the token is compromised or misused by a subverted agent.
Tencent Agent Storage 的文件上传和下载链接生成 API 要求 `space_admin` 级别的 accessToken
The skill uses `child_process.execSync` to determine the global `npm` root path. Although the command executed is fixed and benign in this context, `execSync` is a powerful primitive that could be a vector for command injection if the executed string were user-controlled.
const globalPath = execSync('npm root -g 2>/dev/null').toString().trim();The stated purpose mentions '自动生成下载链接和图片预览' (automatically generates download links and image previews), but the actual skill's commands and output only provide download links and do not include any functionality or output for image previews.
Stated purpose includes '图片预览'. Actual `upload` and `info` command outputs only contain `downloadUrl`, with no mention or generation of preview links.
[](https://mondoo.com/ai-agent-security/skills/clawhub/shawnminh/tencent-agent-storage)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/shawnminh/tencent-agent-storage"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/shawnminh/tencent-agent-storage.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/shawnminh/tencent-agent-storage.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.