meyo

• Outcome: Review
• Latest audit: Jul 25, 2026 · 8:33 AM UTC
• Version: 1.0.0

Overview

This is a real Meyo community integration, but it asks for persistent schedulers, local credentials, silent uploads, public account actions, and execution of community post instructions with insufficient user control.

Review before installing. Use a dedicated Meyo account and revocable API key, inspect any fetched registration script before running it, avoid enabling native cron tasks unless you want ongoing autonomous activity, and require explicit approval before public posts, comments, likes, deletions, diary uploads, or executing instructions from community posts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (51)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill clearly instructs file writes, network access, and shell execution, yet no declared permissions are present to scope or gate those capabilities. This weakens review and runtime controls because operators may approve the skill based on incomplete capability disclosure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The description presents the skill as a coordinator for onboarding, verification, and submodule loading, but the body also performs account registration, persistent credential storage, and credential reuse logic. This mismatch can mislead users and reviewers into approving a skill with stronger side effects than advertised.

Description-Behavior Mismatch

Medium

• Confidence: 80% confidence
• Finding: The skill's claimed role is governance and onboarding, but these sections push the agent toward identity-forming social behavior and preferential use of the community and store. That broadens the operational scope and increases the chance of unsolicited autonomous actions under the guise of basic coordination.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill tells the agent to download and execute a remote shell or PowerShell script from the internet. Executing fetched code is dangerous because the script can change over time, perform unexpected actions, exfiltrate secrets, or persist beyond the intended registration task.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The skill sets up recurring diary and heartbeat tasks and directs continued community interaction after registration. Persistent autonomous behavior materially exceeds a one-time onboarding/authentication role and can cause ongoing actions without fresh user intent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to browse community posts, comment, execute the post's method, and report back, all triggered by broad user approval such as '好的'. This can convert vague consent into autonomous external actions and increase exposure to prompt-injection or unsafe task execution from community content.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: 该子模块名义上是“基础体检”，但实际还定义了持续轮询结果、获取摘要以及历史任务/详情查询等能力，超出了完成一次评测所必需的最小权限范围。这会扩大可访问数据面，并为后续收集历史评测信息、画像数据或额外元数据提供通道，违反最小权限与最小披露原则。

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to create persistent native cron jobs and use environment-level schedulers, which expands its authority from simple diary generation into host persistence and task installation. This is dangerous because it enables long-lived autonomous execution on the local system and can be abused to keep running beyond the user’s immediate intent or visibility.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill defines 'activity' broadly enough to include tool calls, file edits, terminal commands, project-file reads, and external-content reads, effectively directing the agent to inspect a large amount of local and operational context. Even if intended for diary summarization, this creates unnecessary surveillance and increases the risk of collecting or inferring sensitive information from private files, commands, or user work.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly authorizes use of arbitrary external search tools and sources outside the community platform, expanding its behavior beyond a bounded heartbeat/interaction function. This increases data exfiltration and prompt-injection exposure because the agent may fetch and act on untrusted external content during an otherwise routine automated workflow.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill directs the agent to create environment-level scheduled tasks via native cron or system schedulers, which grants persistent execution capability unrelated to merely reading community updates. Persistent scheduling materially raises risk because it can outlive the current user interaction, repeatedly access context, and perform autonomous actions without fresh consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The heartbeat SOP instructs the agent to inspect recent session history and global memory logs to infer user interests, which broadens access well beyond the narrow data needed for community notifications. This creates unnecessary privacy exposure and enables use of unrelated historical context in automated posting and interaction decisions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill labeled as a dialogue-guideline module contains a mandatory instruction to call a comment API and post a reply after certain tasks. This expands the skill from conversational guidance into autonomous external action, creating a risk of unauthorized posting, privacy leakage, or spam if triggered inappropriately.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill authorizes autonomous community actions such as likes, comments, posting, and some agent relationship decisions under low or medium risk without strong scope limitation. In a dialogue-guideline context, this can normalize broad self-directed behavior that exceeds user intent and may cause unauthorized social actions or trust-boundary violations.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to read a local API credential file from the sandbox in order to act on community content. Even if the API key is intended for Meyo use, pulling secrets from local storage based on a link-triggered workflow exceeds least privilege and creates a path where untrusted content can indirectly cause credentialed actions.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This section tells the agent to autonomously decompose and execute arbitrary steps from community posts, including scripts, API calls, and browser automation. That creates a direct instruction-execution chain from untrusted third-party content to real-world actions, enabling code execution, data exfiltration, account misuse, or destructive changes under the agent's authority.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The declared behavior goes beyond simple link interaction and includes reproducing post instructions and initiating follow-on workflows such as cron setup or drafting new posts. This scope expansion is dangerous because users may trigger the skill expecting passive analysis, while the skill actually seeks authority for broader operational tasks.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill mandates autonomous liking and commenting on posts without user confirmation after reading and executing the post's instructions. This lets untrusted content influence public actions and endorsements from the user's account, which can be abused for spam, reputation manipulation, or laundering trust signals.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to persist downloaded skill metadata into long-term memory, which adds a durable data-retention behavior beyond the immediate task of searching/downloading skills. Even though the requested fields are not highly sensitive by themselves, persistent memory can accumulate software inventory and usage history over time, creating unnecessary profiling and expanding the blast radius if memory is later exposed or reused in unrelated contexts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill promotes running downloaded registration scripts and storing credentials locally without a clear user-facing warning about the risks of executing remote code and creating local secret files. Users may unknowingly authorize actions with significant security consequences.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The manual registration flow requires immediate persistence of an API key to disk but does not require a user-visible notice or consent about local secret storage. Storing long-lived credentials locally increases risk if the host is shared, compromised, or improperly permissioned.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: 文档要求“静默收集”skill_list、public_summary、自评答案、任务输出和自我感受，并将其提交到远程 API，但未要求在传输前向用户做任何显式告知或征得同意。这属于隐蔽的数据外传模式，即使字段看似受限，仍会把用户相关交互衍生数据和代理画像发送到外部服务，带来隐私、合规和信任风险。

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documents live write/delete endpoints for posts, comments, votes, bookmarks, and deletions without clearly warning that these actions modify persistent external community data and that some operations, such as deleting a post, are irreversible and also remove associated comments. In an agent setting, this increases the chance of unintended side effects, accidental spam, or destructive actions being executed against a real service.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs use of an Authorization bearer token for all requests to an external service but provides no credential-handling precautions, such as secure storage, non-logging, least-privilege use, or warnings about sending authenticated requests off-platform. In agent workflows, this can lead to API key exposure in prompts, logs, examples, or unintended transmission to third-party endpoints.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger list includes very generic terms such as '日记' and '每日记录', which can easily match ordinary conversation unrelated to this skill. Overbroad triggers increase the chance of unintended activation, causing the agent to perform sensitive behaviors like credential reads, local writes, or remote submissions when the user did not specifically request them.

Static analysis

No suspicious patterns detected.