Reviewcourt

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent meeting-review purpose, but it asks users to install a mutable global CLI before handling sensitive meeting and PRD data.

Install only if you are comfortable granting a local Tencent Meeting CLI access to meeting recordings, transcripts, participant data, and related PRDs. Prefer a pinned or isolated tmeet installation, verify the package source before authorizing OAuth, and avoid running it in a workspace containing unrelated sensitive files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Global Installation of a Mutable CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–65
Vulnerability Type: Supply-chain risk from an unpinned npm dependency
Risk Level: Medium

Vulnerable Code

markdown

2. 若不存在，说明缺少腾讯会议 CLI，并在用户确认后安装：

   ```bash
   npm install -g @tencentcloud/tmeet@latest

text

### Technical Analysis

The Skill instructs the Agent to install `@tencentcloud/tmeet` globally using the mutable `latest` npm tag. It does not pin a reviewed version, verify package integrity, constrain the registry, or validate the installed artifact.

As a result, the code ultimately installed and executed can differ from the version assessed when this Skill was reviewed. An npm package installation may also execute lifecycle scripts with the privileges of the user running the Agent. User confirmation reduces the chance of an unnoticed installation, but it does not verify the safety or identity of the package version selected by `latest`.

This is a supply-chain weakness rather than evidence that the named package is currently malicious.

### Attack Path

1. An attacker compromises the package publisher, npm account, package distribution channel, or a future release selected by the `latest` tag.
2. The attacker publishes package code or lifecycle scripts under a version resolved by `@tencentcloud/tmeet@latest`.
3. The target system does not already have the `tmeet` command.
4. The Skill recommends the documented global installation, and the user approves it.
5. npm downloads the mutable package release and may execute its lifecycle scripts.
6. Malicious code runs with the permissions of the user operating the Agent.
7. The installed CLI may subsequently access local files, environment variables, OAuth state, and meeting data available in that execution context.

### Impact Assessment

Successful exploitation could provide code execution under the installing user's account. The reachable scope may include:

- Files and environment variables accessible to the Agent 
...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed version:

   bash

   npm install -g @tencentcloud/tmeet@<reviewed-exact-version>
   

2. Document an explicit upgrade process that includes security review before changing the pinned version.

3. Verify that npm resolves the package from the expected registry and publisher namespace.

4. Record and verify the expected package integrity or provenance where the installation mechanism supports it.

5. Prefer a project-local or isolated installation over a global installation to reduce scope and simplify removal.

6. Disable npm lifecycle scripts during installation if the package can function without them:

   bash

   npm install --ignore-scripts --save-exact @tencentcloud/tmeet@<reviewed-exact-version>
   

7. If lifecycle scripts are required, inspect them before installation and run the installation with the least-privileged account available.

8. After installation, verify the executable path and version before authentication or access to sensitive meeting data.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file is entirely written as a prescriptive handbook in Chinese and includes output templates, wording constraints, and fixed phrasing such as '评审建议', indicating the skill is expected to operate in Chinese by default. There is no opt-in language selection or documented justification that this is a China-specific or Chinese-only workflow, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest description is written entirely in Chinese and frames the skill behavior in that locale, while the policy requires avoiding language or locale constraints unless the user is given a choice or the restriction is clearly justified. Although a brief bilingual heading appears later, the skill does not explicitly state that users may interact in their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest includes the tag "chinese", and the name/tagline/description prominently present Chinese-language positioning. For a manifest file, this can indicate a language-specific constraint, but the file does not explicitly say users can choose language or that the restriction is required for a region-specific compliance purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.