Workshop Agenda Designer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:13 AM UTC
• Version: 1.0.0

Overview

This meeting-agenda skill mostly runs locally, but its bundled script includes under-disclosed local audit and scanning modes unrelated to agenda design, so it needs review before installation.

Install only if you are comfortable with a local Python skill package that contains file and directory audit code beyond agenda drafting. Use it only with explicit meeting-material inputs, avoid pointing it at sensitive repositories or broad directories, and prefer removing or clearly documenting the audit modes before general use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个会议策划/主持辅助技能，应围绕会议目标、参会人、时间和约束生成议程、脚本、产出物及跟进内容。但代码并未体现任何会议领域特定逻辑，也没有解析参会人、会议目标、时间约束等输入模型。相反，代码的核心能力由 spec['mode'] 驱动，支持 structured_brief、directory_audit、csv_audit、pattern_audit、skill_audit 等通用审计/扫描任务；其中还包含文件遍历、CSV 字段统计、风险正则匹配、Skill 目录完整性检查等与会议工作流明显无关的能力。这属于主要用途与实际行为实质不一致，且代码具备多项未声明的审计/扫描能力，因此应判定为描述与行为不匹配。

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script’s implemented capabilities materially diverge from the declared meeting-agenda purpose: it can scan arbitrary files, inspect directories, audit skill packages, and generate security-style reports. This scope mismatch is dangerous because it enables collection and analysis of local project contents a user would not reasonably expect to expose to a facilitation skill, increasing the risk of unauthorized data discovery and misuse.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The pattern scanner searches arbitrary files for secrets, shell-execution constructs, and private URLs, which is unrelated to workshop agenda design. In this skill context, that behavior is highly suspicious because it can enumerate sensitive material from local repositories or documents under the guise of a benign productivity tool.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The README’s title and core functional description are entirely in Chinese, with no indication that users may choose another language or locale. This can violate a language/locale policy when the skill effectively forces one language without opt-in or documented regional justification.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This markdown file presents all user-facing content in Chinese and does not indicate that the language is optional or selectable. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy concern.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares executable capability via `python3` and references local resources and generated output, but it does not explicitly restrict tool scope with `permissions` or `allowed-tools`. In an agent environment, this can lead to broader-than-necessary file and shell access, increasing the chance of unintended reads, writes, or command execution beyond agenda-generation needs.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The entire skill content is written in Chinese and provides instructions only in that language, which can amount to a language/locale constraint without explicitly offering the user a choice or opt-in. Under the policy, language restrictions should be optional or clearly justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The entire example output is written in Chinese and the title indicates a fixed Chinese-language format, but there is no indication that the user can choose another language or that the locale restriction is required. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file presents all user-facing content in Chinese and does not indicate that the language was chosen by the user or that alternatives are available. This can violate language/locale policy requirements when a skill forces a specific language without user opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The title, category label, summary, and input hint are all written in Chinese, which indicates a language-specific skill presentation. The file does not document that the skill is intended only for Chinese-speaking users or provide any user choice of language, which may violate language/locale policy expectations.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The template headings and instructions are entirely in Chinese, which implies the skill expects or enforces Chinese-language output. Under the policy, language-specific constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The generated report strings in make_structured_report are hard-coded in Chinese, which imposes a specific language on users without any opt-in or configuration. This matches the language/locale policy violation category because the skill does not offer a language choice or justify a Chinese-only scope.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The directory audit functionality recursively lists files, samples contents, and extracts Markdown headings from arbitrary directories, which exceeds the stated facilitation workflow scope. While not destructive, it can expose project structure and document content metadata that may be confidential, especially when invoked on broad paths.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: directory_report, csv_report, pattern_report, and skill_audit all emit user-visible headings and guidance in Chinese only. Because the script exposes these reports through CLI output and file writes without any language selection, it forces a locale in a way that violates the stated natural-language policy rule.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The description string forces a mixed Chinese/English presentation for the skill but does not state that the user can choose their preferred language. This can violate language/locale policy expectations when a skill imposes a language format without explicit opt-in or documented justification.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The file content is presented entirely in Chinese, and the title at L01 indicates the skill/test is for a Chinese-language workflow without any mention of language choice or opt-in. Under the policy rule, forcing a specific language can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.