Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Security audit
会议健康度分析仪
Security checks for vulnerabilities and agentic risk
Overview
This skill analyzes meeting participation and notes as advertised, with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.
Install this only where analyzing meeting attendance, speaking time, and minutes is appropriate. Confirm the meeting ID or local files before use, and make sure participants and your organization permit using meeting reports and notes for this kind of analysis.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad and map to common meeting-related requests, which raises the chance of unintended invocation in unrelated conversations about participation or efficiency. Accidental activation can cause the agent to pull meeting reports or notes containing sensitive attendance and speech data when the user did not clearly intend that action.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
All user-facing trigger phrases, examples, and instructions are presented only in Chinese, and the file does not state that language selection is optional or limited to a specific region for compliance reasons. This can amount to a language-policy violation if the organization expects skills not to force a single language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The module docstring, CLI description, argument defaults, and user-facing output are all Chinese-only, which imposes a specific language on users without opt-in. The policy allows locale constraints when documented and justified, but this file does not state that it is intentionally limited to Chinese-speaking users or a region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The entire skill description, examples, parameters, and outputs are presented only in Chinese, including the example invocation and generated report names. This can constitute a language/locale policy issue because the skill appears to assume Chinese usage by default without explicitly offering an opt-in choice or stating that it is intentionally limited to a Chinese-speaking context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This file uses Chinese-only headers and content, which can reflect a fixed language/locale assumption. Under the policy, forcing a specific language without user opt-in or documented justification can be a natural-language policy violation.
- Content