Security audit

Meeting Risk Radar

Security checks for vulnerabilities and agentic risk

Overview

The skill’s meeting-prep purpose is mostly clear, but its bundled script contains under-disclosed local audit and pattern-scanning modes that go beyond meeting-risk analysis.

Review this before installing if you only wanted a narrow meeting-prep assistant. The normal bundled configuration generates local meeting-risk briefs, but the package also ships dormant audit/scanning code that can inspect local directories and files if enabled, so install it only in workspaces where that broader local inspection capability is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared purpose is narrowly framed as meeting-risk preflight, but the referenced behavior indicates broader audit-style capabilities such as directory enumeration, data-field inspection, pattern/secret scanning, and package structure checking. This mismatch is dangerous because users and policy engines may trust the skill with meeting notes while it can actually inspect unrelated local content, increasing the chance of over-collection, privacy violations, or misuse under misleading pretenses.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The pattern scanning logic searches arbitrary files for secrets, internal URLs, and shell-command indicators, which is unrelated to meeting facilitation and turns the skill into a lightweight security scanner. In a trusted agent context, this can be used to inspect sensitive repositories or documents and surface security-relevant content outside the skill's advertised scope.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill_audit routine inspects other skills' file structures and parses SKILL.md frontmatter, effectively providing a generic capability to audit neighboring projects. This broadens the tool into a meta-analysis utility that can inventory and analyze unrelated local assets, creating a capability mismatch and increasing the risk of unauthorized local inspection.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The dispatcher enables multiple generic audit modes such as directory, CSV, pattern, and skill auditing, which materially exceeds the declared meeting-risk facilitation purpose. This scope expansion allows the skill to be repurposed for broad local file inspection and analysis, increasing the chance of unintended data access and policy bypass in environments that trust the skill's stated narrow purpose.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrases are very broad natural-language requests such as asking to check meeting risks or what materials are needed before a meeting. In an agent workspace, overly generic triggers can cause unintended activation on ordinary conversation, leading the skill to run in contexts where it was not explicitly intended and potentially process sensitive meeting-planning content unnecessarily.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill advertises executable capabilities via `python3` and references local resources for input/output generation, but it does not declare an explicit tool scope such as `permissions` or `allowed-tools`. This creates a governance gap: a host may permit broader shell or file access than intended, making it harder to enforce least privilege and easier for a seemingly benign meeting workflow to access or write arbitrary local files.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The title, summary, input hint, examples, and risk text are all presented only in Chinese, which signals a language-specific skill experience. The file does not document that Chinese is optional, user-selected, or required for a justified region-specific use case, so this appears to impose a locale/language constraint without opt-in.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The generated report strings are written in Chinese (for example '结果', '摘要', and '下一步') and there is no option to select or opt into another language. This creates a language/locale policy issue because the skill forces a specific language in user-facing output.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The directory audit mode recursively enumerates text files and extracts filenames, extensions, and Markdown headings from an arbitrary path. Even without exfiltration over the network, this exposes repository structure and document content summaries that may be sensitive and is inconsistent with the claimed meeting-risk-only purpose.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: Multiple reporting functions emit Chinese-only headings and guidance such as '扫描报告', '字段概览', and '发现结果'. Because the script presents these messages directly to users and provides no language selection, it violates the stated policy on forcing a specific language or locale.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: Error/status messages like 'SKILL.md 缺少前置 frontmatter', '规范检查', and related section text are fixed in Chinese. Since the skill does not offer users a language choice or justify a region-specific constraint, this is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The file is entirely written in Chinese and presents a fixed output structure with Chinese headings, but there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy rule for natural-language constraints, this can be a locale/language policy issue when no opt-in or justification is provided.

Static analysis

No suspicious patterns detected.