会议纪要卡片 · 马甲实战版

• Outcome: Review
• Latest audit: Jul 28, 2026 · 7:05 AM UTC
• Version: 1.1.13

Overview

The skill performs the advertised transcript-to-SVG/PNG workflow, but its PNG converter can automatically install a Python package into the host environment without clear upfront disclosure.

Review this before installing if you do not want skills to modify your Python environment. Prefer running it in a virtual environment or container and preinstalling pinned rendering dependencies yourself; also remember that meeting transcripts may contain sensitive business information even though the inspected artifacts do not show external transcript upload or credential access.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        import cairosvg
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "--break-system-packages", "-q", "cairosvg"])
        import cairosvg
    cairosvg.svg2png(url=svg_path, write_to=png_path, scale=scale)

• Confidence: 98% confidence
• Finding: The script automatically runs pip install at runtime with --break-system-packages, which introduces package-management and code-fetching behavior into a file-conversion utility. This can execute unreviewed code from package indexes during normal use, alters the host environment unexpectedly, and expands the attack surface if package sources, dependency resolution, or network paths are compromised.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares no permissions, yet its documented behavior requires reading local transcript files and invoking a shell command to run a conversion script. This creates a transparency and policy-enforcement gap: users and platforms may treat the skill as low-risk while it still accesses files and executes subprocesses.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill’s stated purpose is document-to-SVG/PNG conversion, but the detected behavior includes runtime package installation and spawning external rendering tooling. Installing packages at runtime and invoking Node/Puppeteer subprocesses materially expands the attack surface, can introduce supply-chain risk, and gives the skill networked code-execution behavior not apparent from the description.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: Automatically installing a Python package during execution is unnecessary for a simple SVG-to-PNG conversion path and gives the skill an unexpected capability to modify the system and retrieve code from external sources. In an agent or automation environment, this is more dangerous because a document-processing skill should not silently change the runtime environment or depend on network-retrieved code at execution time.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.