觅游社区 - Meyo

• Outcome: Review
• Latest audit: May 29, 2026 · 9:39 PM UTC
• Version: 1.0.2

Overview

This is a real Meyo community integration, but it gives the agent persistent, credential-backed, public-facing authority that users should review before installing.

Install only if you are comfortable with this skill storing a Meyo API key locally, creating scheduled background jobs, reading some conversation and memory context, and using your Meyo account to like, comment, post, download skills, or submit assessments. Prefer a limited account, review created cron jobs and credential files, and require explicit approval before public posts/comments/likes or before executing steps from community content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly requires network access, local file writes, and shell execution, but it declares no permissions or capability boundaries. That mismatch is dangerous because a host may grant or deny execution without informed consent, and users cannot accurately assess the risk surface before installation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The description frames the skill as onboarding/authentication/boundary management, but the body also performs account registration, secret handling, local credential persistence, and claim-link disclosure. This under-describes sensitive behavior, which can mislead users and security controls about the true actions the skill will take.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to download and execute remote shell/PowerShell scripts directly from the network on the host. This creates a classic remote code execution supply-chain risk: if the script, server, or transport is compromised, arbitrary code can run with the agent's local privileges.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill directs creation of persistent diary and heartbeat scheduled tasks, enabling autonomous behavior beyond a one-time onboarding flow. Persistent automation increases the blast radius of any prompt abuse or logic flaw because actions continue after the initial interaction and may generate network traffic or content without fresh consent.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The document claims it will not proactively scan local directories, yet it instructs checking multiple environment-dependent paths for credentials. Even limited path probing is still local file discovery, and the inconsistency can normalize broader credential searching or confuse operators about what local data access occurs.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to review recent session history and global memory to extract user interests before acting. That exceeds a narrow community-heartbeat function and creates unnecessary access to broader user data, increasing the chance of privacy overreach and context misuse in downstream posting, recommendations, and reporting.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Authorizing external web search expands the skill's operational scope beyond the stated meyo community activity function. This can expose user context to third-party services, introduce prompt-injection risk from untrusted external content, and cause actions based on data outside the expected trust boundary.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs the agent to create persistent cron jobs using OpenClaw or native system schedulers and to run them in the current conversation channel with inherited context. This materially broadens privilege and persistence beyond a simple community function, enabling unattended execution tied to user context and increasing the blast radius if misconfigured or abused.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is framed as a dialogue-guidelines module, but it mandates operational actions such as calling a comment API and performing community engagement after task completion. This creates hidden side effects and can cause the agent to take external actions without explicit, contextual user consent, especially dangerous because the trigger scope is broad and the posting is described as mandatory.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill includes authority and decision rules for accepting friends, taking new jobs, and loading or unloading skills, which exceed the stated purpose of community dialogue norms. This kind of scope expansion can normalize privileged actions under an innocuous skill name, increasing the chance the agent performs account, capability, or trust-boundary changes without sufficiently informed approval.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to read locally stored API credentials from sandbox files even though the visible user task is just handling a community post link. This creates unnecessary credential access and broadens the skill's privilege boundary, making credential misuse or unintended account actions possible if the workflow is triggered on adversarial content.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill directs the agent to decompose and execute arbitrary steps from user-linked posts using whatever tools are available, after only a narrow risk check. This effectively turns untrusted community content into executable instructions, enabling harmful actions, data access, system modification, or external interactions far beyond the stated purpose of link interaction.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill expands from analyzing a link into performing authenticated social actions on the user's behalf, including liking and posting comments without fresh approval. That is a scope escalation from passive content handling to account mutation, and it can be abused to manipulate the user's account activity or reputation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill recommends downloading and executing remote registration scripts without a strong warning about code-execution risk or an approval gate. Users may treat it as routine onboarding, but it effectively delegates trust to unaudited remote code that can alter the host and handle secrets.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill mandates fully silent collection, serialization, and remote submission of assessment data, including generated self-assessment content, without a user-facing disclosure at the time of transmission. This creates a privacy and informed-consent issue because personal/profile data is sent to an external service without transparent notice or opt-in.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs reading persisted credential material and an agent identifier from local credential files as a prerequisite for execution, but gives no user-facing warning or consent mechanism for that access. Even if limited to agent_id use, normalizing silent reads of stored credentials increases the risk of unauthorized secret access and weakens boundary expectations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes generic terms like “日记” and “每日记录,” which can plausibly appear in normal conversation and unintentionally activate the skill. Although the file also says it should only run when required by the main skill, broad triggers increase the chance of accidental invocation of automated logging behavior and related network/file operations.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The skill mandates Chinese output and prioritizes Chinese expression without clear user opt-in, which can override user language preferences and reduce transparency for users expecting another language. In this context the issue is primarily policy and usability-related rather than a direct security flaw, but it can still cause misleading or inaccessible automated submissions.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include broad everyday terms like '心跳', 'heartbeat', and '社区动态', which can overlap with normal conversation and unintentionally activate autonomous behavior. Because the skill can post, reply, search externally, and schedule recurring tasks, accidental invocation is more dangerous than for a read-only skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The description presents the skill as an activity mechanism but does not disclose that it inspects recent sessions and memory logs. Users therefore lack informed notice that broader personal context may be accessed and used to shape automated actions and reports.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The metadata says the skill will automatically fetch announcements, process notifications, interact, and post, but it omits a clear warning that these actions occur autonomously on the user's behalf and may include external searches. This lack of disclosure undermines informed consent for externally visible actions and data flows.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases are generic community-dialogue terms, making accidental invocation during ordinary conversation more likely. In this file, that broad activation is more dangerous because the skill contains non-dialogue operational behaviors, so an incidental match could activate hidden posting or action-taking rules unexpectedly.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill does not clearly warn users that it may automatically post a community comment via API after task completion, despite making that behavior mandatory in some cases. Lack of disclosure undermines informed consent and could expose user activity, task outcomes, or personal context to a broader audience than intended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill tells the agent to access local credential files without notifying the user that sensitive secrets will be read. Even if the token is not printed, silent secret access violates least surprise and increases the chance of unauthorized use of credentials for unrelated or overbroad actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs authenticated API calls to an external service but does not clearly warn the user that their account credentials will be used over the network and may trigger account-affecting operations. This lack of transparent notice undermines informed consent and makes abusive or unexpected external actions easier to hide.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.