Meet

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:55 AM UTC
• Version: 1.0.0

Overview

The skill fits a task-marketplace workflow, but it can transfer local files and perform marketplace actions from broad phrases while installing an unpinned external CLI.

Review before installing. Use it only for intended Meet tasks, confirm before publishing, claiming, delivering, completing, abandoning, uploading, or downloading, and avoid sending directories that contain secrets or unrelated private files. Install meet-cli from a trusted, pinned source where possible and handle downloaded deliverables as untrusted until reviewed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:10

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 10-12 and 18-20
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

package: meet-cli
bins:
  - meet

bash

pip install meet-cli

Technical Analysis

The Skill installs meet-cli from the configured Python package index without specifying an exact version, verifying a cryptographic hash, or constraining the package source to a reviewed artifact. Consequently, the code installed when the Skill is activated can change independently of the reviewed project.

Python package installation may execute package-controlled build or installation logic. If the package distribution, maintainer account, package index, or dependency chain is compromised, malicious code could run during installation or when the meet command is invoked. The project contains no vendored implementation, lockfile, integrity metadata, or trusted-source declaration that would allow the installed code to be verified against a reviewed version.

This finding does not establish that the current meet-cli package is malicious. The vulnerability is the absence of version and integrity controls around executable third-party code.

Attack Path

1. An attacker compromises the package publisher, package index, release process, or a transitive dependency used by meet-cli.
2. The attacker publishes a malicious or backdoored release under the package name expected by the Skill.
3. The Skill is installed or activated after that release becomes available.
4. pip install meet-cli resolves and downloads the attacker-controlled release because no exact version or hash is required.
5. Package-controlled code executes during installation or when the Agent invokes the installed meet binary.
6. The malicious code operates with the privileges and filesystem or network access of the user running the Agent.

Impac

...[truncated 599 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin meet-cli to an exact version that has been independently reviewed, rather than allowing pip to select the latest available release.
2. Require cryptographic hashes for the package and all transitive dependencies, such as through a hash-locked requirements file installed with pip install --require-hashes.
3. Generate and retain a lockfile or constraints file so dependency resolution is reproducible.
4. Document and enforce the trusted package index or verified official distribution source. Disable unintended fallback indexes to reduce dependency-confusion exposure.
5. Verify package provenance and release signatures where supported, and periodically review the pinned artifact and its dependency tree.
6. Install the CLI in an isolated virtual environment or sandbox under a non-privileged account.
7. Restrict the installed process to only the filesystem paths and network destinations required for Meet operations.
8. Update the installation example to reference the reviewed version and integrity-controlled installation process instead of pip install meet-cli.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs users to upload local directories with publish/deliver and to download remote deliverables with download, but it does not warn about the privacy, confidentiality, or malware risks of transferring local files through the platform. In this context, the skill explicitly supports outsourcing work to other people or AI, which increases the chance that sensitive files are shared externally or that downloaded artifacts are trusted without adequate review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The decision-tree uses broad natural-language trigger phrases such as '帮我把这个任务发出去', '看看有什么任务可以做', and '通过了', which are common conversational intents and can cause accidental activation of a skill that performs external side effects. In this skill, unintended activation is more dangerous because commands can publish tasks, claim work, download files, and mark tasks complete on a third-party platform, potentially causing data exposure or irreversible workflow actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.