Security audit

会议智脑（MeetingOS）

Security checks for vulnerabilities and agentic risk

Overview

This meeting automation skill has legitimate features, but it also contains unrelated review instructions, hidden promotional links, and under-scoped network behavior that needs manual review before use.

Review carefully before installing. Use only with non-sensitive meetings and test credentials unless the maintainer removes the unrelated GitHub/repository instructions and hardcoded promotional links, validates all outbound URLs, enforces download size limits, and makes cloud transcription an explicit validated choice.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: scripts/feishu_helper.py:184
Finding: Persistent Promotional Link Injection into Generated Meeting Content
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:107
Finding: Unrelated Repository-Modification and External Review Instructions Embedded in the Skill
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/meeting_fetcher.py:44
Finding: Arbitrary URL Download Enables SSRF and Unbounded Disk Consumption
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/meeting_fetcher.py:174
Finding: WeCom Access Token May Be Disclosed to an Unvalidated Download Host
Content: View full analysis
` to the unvalidated URL. 4. `_download ...[truncated 733 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main_processor.py:13
Finding: Meeting Content Can Be Posted to Arbitrary Webhook Destinations
Content: View full analysis
bool: try: response = requests.post( webhook_url, json={"msg_type": "text", "content": {"text": text}}, timeout=10, ) return response.status_code == 200 except Exception as error: print(f"飞书发送失败：{error}") return False ``` ```python webhook = os.getenv("FEISHU_WEBHOOK_URL", "") if webhook: print("正在推送到飞书...") ok = send_feishu_text(webhook, f"会议行动项：\n{action_summary}") ``` ```python if not WECOM_WEBHOOK_URL: raise ValueError("❌ 未设置 WECOM_WEBHOOK_URL") response = requests.post(WECOM_WEBHOOK_URL, json=payload, timeout=10) ``` ### Technical Analysis Webhook transmission is a legitimate part of the declared optional integrations. However, the implementations trust environment-provided URLs without validating: - URL scheme. - Official service hostname. - Resolved destination address. - Redirect destination. - Whether the user approved transmission to that destination. The payload can include action items or meeting-derived content. If the environment is poisoned, copied incorrectly, or managed by another process, sensitive meeting data may be posted to an unintended endpoint. Allowing HTTP also permits plaintext transmission and network interception. Arbitrary destinations can additionally turn the webhook functions into limited SSRF primitives. ### Attack Path 1. An attacker or compromised deployment process modifies `FEISHU_WEBHOOK_URL` or `WECOM_WEBHOOK_URL`. 2. The user processes a meeting or invokes a webhook helper. 3. The code automatically posts meeting-derived content to the configured URL. 4. The attacker ...[truncated 687 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/transcribe.py:184
Finding: Invalid Privacy-Mode Values Silently Cause Cloud Audio Upload
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (69)

Tainted flow: 'FEISHU_APP_ID' from os.getenv (line 16, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 49)May include surrounding context.
python
) # 向飞书服务器请求令牌 response = requests.post( f"{BASE_URL}/auth/v3/tenant_access_token/internal", json={"app_id": FEISHU_APP_ID, "app_secret": FEISHU_APP_SECRET}, timeout=10,

Tainted flow: 'payload' from os.getenv (line 251, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 100)May include surrounding context.
python
} # 发送请求 response = requests.post( f"{BASE_URL}/im/v1/messages", headers=get_auth_headers(), params={"receive_id_type": "chat_id"},

Tainted flow: 'payload' from os.getenv (line 251, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 257)May include surrounding context.
python
} # 发送请求 response = requests.post( f"{BASE_URL}/im/v1/messages", headers=get_auth_headers(), params={"receive_id_type": "chat_id"},

Tainted flow: 'payload' from os.getenv (line 251, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 302)May include surrounding context.
python
if due_ms: payload["due"] = {"timestamp": str(due_ms // 1000)} response = requests.post( f"{BASE_URL}/task/v2/tasks", headers=get_auth_headers(), json=payload,

Tainted flow: 'url' from os.getenv (line 347, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 350)May include surrounding context.
python
url = f"{BASE_URL}/bitable/v1/apps/{atoken}/tables/{tbl}/records/batch_create" payload = {"records": [{"fields": r} for r in records]} response = requests.post( url, headers=get_auth_headers(), json=payload,

Tainted flow: 'WECOM_CORP_ID' from os.getenv (line 16, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/meeting_fetcher.py (reported line 81)May include surrounding context.
python
if not WECOM_CORP_ID or not WECOM_AGENT_SECRET: raise ValueError("❌ 缺少 WECOM_CORP_ID 或 WECOM_AGENT_SECRET") r = requests.get( "https://qyapi.weixin.qq.com/cgi-bin/gettoken", params={"corpid": WECOM_CORP_ID, "corpsecret": WECOM_AGENT_SECRET}, timeout=10,

Tainted flow: 'FEISHU_APP_ID' from os.getenv (line 18, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/meeting_fetcher.py (reported line 102)May include surrounding context.
python
if not FEISHU_APP_ID or not FEISHU_APP_SECRET: raise ValueError("❌ 缺少 FEISHU_APP_ID 或 FEISHU_APP_SECRET") r = requests.post( "https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal", json={"app_id": FEISHU_APP_ID, "app_secret": FEISHU_APP_SECRET}, timeout=10,

Tainted flow: 'SKILLPAY_API_KEY' from os.getenv (line 13, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/skillpay_guard.py (reported line 35)May include surrounding context.
python
return True try: response = requests.post( f"{BILLING_URL}/charge", headers={ "X-API-Key": SKILLPAY_API_KEY,

Tainted flow: 'SKILLPAY_API_KEY' from os.getenv (line 13, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/skillpay_guard.py (reported line 86)May include surrounding context.
python
return -1 try: response = requests.get( f"{BILLING_URL}/balance", headers={"X-API-Key": SKILLPAY_API_KEY}, params={

Tainted flow: 'SKILLPAY_API_KEY' from os.getenv (line 13, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/skillpay_guard.py (reported line 119)May include surrounding context.
python
return "https://skillpay.me" try: response = requests.post( f"{BILLING_URL}/payment-link", headers={ "X-API-Key": SKILLPAY_API_KEY,

Tainted flow: 'WECOM_CORP_ID' from os.getenv (line 14, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 41)May include surrounding context.
python
"❌ 缺少配置：请设置 WECOM_CORP_ID 和 WECOM_AGENT_SECRET" ) response = requests.get( f"{BASE_URL}/gettoken", params={"corpid": WECOM_CORP_ID, "corpsecret": WECOM_AGENT_SECRET}, timeout=10,

Tainted flow: 'payload' from os.getenv (line 165, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 80)May include surrounding context.
python
"text": {"content": content}, } response = requests.post( f"{BASE_URL}/message/send", params={"access_token": get_access_token()}, json=payload,

Tainted flow: 'payload' from os.getenv (line 165, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 122)May include surrounding context.
python
"text": {"content": content}, } response = requests.post( f"{BASE_URL}/message/send", params={"access_token": get_access_token()}, json=payload,

Tainted flow: 'payload' from os.getenv (line 165, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 178)May include surrounding context.
python
"text": {"content": content}, } response = requests.post( f"{BASE_URL}/message/send", params={"access_token": get_access_token()}, json=payload,

Tainted flow: 'WECOM_WEBHOOK_URL' from os.getenv (line 17, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: The webhook destination is taken directly from an environment variable and used as the full POST target without validation or domain restriction. If that variable is misconfigured or attacker-controlled, sensitive message content can be silently exfiltrated to an arbitrary endpoint instead of WeCom.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 219)May include surrounding context.
python
}, } response = requests.post(WECOM_WEBHOOK_URL, json=payload, timeout=10) response.raise_for_status() result = response.json()

Tainted flow: 'WECOM_WEBHOOK_URL' from os.getenv (line 17, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: This markdown webhook function has the same issue as the text webhook path: it trusts an environment-provided full URL as the outbound destination. In environments where configuration can be influenced, this creates an easy exfiltration primitive for arbitrary markdown content.
Content: Scanner excerpt · scripts/wecom_helper.py (reported line 242)May include surrounding context.
python
payload = {"msgtype": "markdown", "markdown": {"content": content}} response = requests.post(WECOM_WEBHOOK_URL, json=payload, timeout=10) response.raise_for_status() result = response.json()

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 1)May include surrounding context.
text
.env

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
md
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
md
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 12)May include surrounding context.
python
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 45)May include surrounding context.
python
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/feishu_helper.py (reported line 82)May include surrounding context.
python
import requests from dotenv import load_dotenv # 读取 .env 文件里的配置（只读取，不联网） load_dotenv() # 从环境变量读取配置（这里只是读取变量，不会发起任何网络请求）

Static analysis

No suspicious patterns detected.