Novelty Validator

• Outcome: Review
• Latest audit: Jul 19, 2026 · 8:43 AM UTC
• Version: 1.7.1

Overview

The skill’s main novelty-checking purpose is coherent, but it asks for broad meeting, identity, recording, and third-party research-text processing authority that users should review carefully.

Install only if you are comfortable letting the skill process meeting transcripts and research ideas through external literature and embedding services. Avoid using it for confidential or pre-publication discussions unless you disable remote embeddings or have explicit participant and data-owner consent. Review Tencent Meeting permissions carefully, especially contact lookup, attendee reports, meeting control, and recording behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes use of environment-backed secrets (`SMARTLIB_GATEWAY_SECRET`, email) and direct network access to external services, yet no declared permissions are present. This creates a transparency and least-privilege problem: users and the platform cannot accurately assess or constrain what data the skill can access or transmit, especially because it processes meeting transcripts that may contain sensitive research content.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The attendee tracing and contact enrichment features go beyond the stated novelty-validation purpose and enable identification of who proposed an idea from meeting artifacts. In an academic collaboration setting, this can expose sensitive participation, attribution, and interpersonal data without necessity, increasing privacy risk and the potential for surveillance or misuse.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill includes creating meetings, controlling meetings, and enabling recordings even though its core task is post-hoc or in-meeting novelty checking. Those capabilities materially expand operational control over user meetings and recording state, creating unnecessary privacy and consent risks if triggered incorrectly or abusively.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The documentation claims that evolution logging is local-only and minimal, but the skill text provides no technical enforcement details to substantiate that guarantee. Because the skill handles meeting-derived research ideas, an unverified privacy claim may mislead users into sharing sensitive content under false assumptions about retention and data locality.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The module sends user claim text and candidate abstracts to an external embedding service, but the skill metadata and call flow shown here do not make that data transfer obvious to the user. In a novelty-check context, claims may contain unpublished research ideas or confidential meeting content, so silent third-party transmission creates a real confidentiality risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents participant tracing and identity lookup capabilities without a prominent user-facing privacy warning in the main description or activation criteria. In context, meeting transcripts and attendee lists can contain sensitive academic, professional, and personal information, so undisclosed enrichment behavior increases the risk of covert identity processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly describes sending the user's claim and candidate title/abstract text to a third-party embeddings API using an API key, but it does not require an explicit user notice, consent step, or data-minimization warning before transmission. In this skill's context, the input may come from meeting transcripts, research ideas, or cross-lab discussions, so outbound embedding can expose confidential or unpublished material and create privacy/IP leakage risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code transmits claim and candidate text to a remote API without any runtime warning, prompt, or visible indication at the call site that sensitive text is leaving the local environment. Because this skill is triggered by meeting transcripts and brainstorming outputs, the transmitted content may include confidential or pre-publication material.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Natural-language instructions to trace participants and enrich proposer identity operationalize sensitive data processing in a way that can be easily invoked by an agent. Even without code, these instructions normalize deanonymization of meeting participants, which is risky in collaborative or academic settings where attribution and identity may be sensitive.

External Transmission

Medium

• Category: Data Exfiltration

Content

| **B · 网关语义端点** | **v1.7 复测稳定，已恢复为主引擎之一** | 复用 global-biblio-base `/search/global` 的语义排序信号（`endpoint:/search/global`+`rule` 正确格式） | 中（跨语言语义信号可用） |
| **C · 本地词重叠（离线兜底）** | 始终可用，无需密钥 | 对 claim 的「方法/问题」关键 token 与候选标题+摘要做归一化命中率：`sim = 命中token数 / claim总token数` | 基础，可捕获术语级邻近 |

> **Tier A 真机实现**：见 `references/vector_recall_impl.py`——读 `SILICONFLOW_API_KEY`（env 优先 → 本技能 `config.json` 兜底），调 `https://api.siliconflow.cn/v1/embeddings`（模型 BAAI/bge-m3），对 claim 与候选 `title+desc` 做余弦，输出降序重排 + `near_miss` 标记。仅标准库（urllib/json/math），无第三方依赖，便于嵌入自动化。
>
> **发布安全**：打包发布时 `config.json`（含密钥）**不进发布包**，避免 key 泄露；使用者安装后自行 `export SILICONFLOW_API_KEY=...` 或在本机 `config.json` 填入自有 key 即可启用 A 档。
>

• Confidence: 88% confidence
• Finding: This file documents an outbound call to `https://api.siliconflow.cn/v1/embeddings`, which means user-provided claims and candidate text leave the local environment and are processed by an external service. In a novelty-checking skill, those inputs can contain sensitive research concepts, unpublished ideas, or meeting-derived content, making external transmission materially risky if performed without strong notice, consent, and handling controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

def __init__(self, model=None, url=None, key=None):
        self.key = key or _load_key()
        self.model = model or os.environ.get("SILICONFLOW_EMBED_MODEL") or "BAAI/bge-m3"
        self.url = url or os.environ.get("SILICONFLOW_EMBED_URL") or "https://api.siliconflow.cn/v1/embeddings"
        self.available = bool(self.key)
        self._cache = {}

• Confidence: 90% confidence
• Finding: The hardcoded default endpoint points to an external embedding service, and the module sends user-supplied novelty-check content there for processing. In this skill's context, that can expose sensitive research ideas, meeting summaries, and candidate abstracts to a third party, making the external transmission security-relevant.

Static analysis

No suspicious patterns detected.