会议纪要卡片 · 马甲实战版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.1.13

Overview

The skill’s meeting-card purpose is coherent, but its PNG converter uses risky automatic execution paths that are under-disclosed.

Review this skill before installing. Use it only on transcripts you are authorized to process, redact sensitive details before creating shareable images, and avoid converting SVG files from untrusted sources. Prefer a pinned, preinstalled dependency environment and do not run the converter with privileged accounts or broad secrets in the environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/svg2png.py:72

Finding

Automatic Installation of an Unpinned Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/svg2png.py:72-77
Vulnerability Type: Unsafe runtime dependency installation
Risk Level: High

Vulnerable Code

python

def convert_cairosvg(svg_path, png_path, scale):
    try:
        import cairosvg
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "--break-system-packages", "-q", "cairosvg"])
        import cairosvg

Technical Analysis

When CairoSVG is unavailable, the conversion script automatically invokes pip and installs the latest available cairosvg package. No exact version or package hash is specified, so the code installed at runtime can differ from the code present when the Skill was audited.

The --break-system-packages option bypasses protections intended to prevent pip from modifying a Python environment managed by the operating system. Installation occurs under the privileges of the user running the Skill and is triggered implicitly during ordinary conversion rather than through a separate, explicit setup process.

This creates a supply-chain trust boundary: a compromised upstream release, package-index account, configured package mirror, DNS/network path, or dependency of CairoSVG could result in attacker-controlled package code being installed and loaded. The script subsequently imports the newly installed package in the same process.

Attack Path

1. The user or agent invokes scripts/svg2png.py as directed by SKILL.md.
2. Node.js is unavailable, Puppeteer conversion fails, or the script otherwise enters the CairoSVG fallback.
3. The local Python environment does not already contain CairoSVG.
4. The script invokes python -m pip install --break-system-packages -q cairosvg.
5. pip resolves an unpinned package and its transitive dependencies from the configured package index.
6. If the resolved supply-chain artifact or index path is compromised, malicious installation or impor ...[truncated 847 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove runtime installation from the conversion path. If CairoSVG is absent, terminate with a clear message describing an explicit installation procedure.
2. Declare CairoSVG and all other required dependencies in a lock file with exact versions and cryptographic hashes.
3. Install dependencies during a deliberate setup phase rather than while processing user content.
4. Use a dedicated virtual environment or locked container instead of modifying the system-managed Python environment.
5. Remove --break-system-packages.
6. Restrict package installation to an approved package index and verify artifacts through hashes or signed provenance.
7. Add dependency scanning and automated update review to the release process.
8. Update SECURITY.md, which currently describes only a one-time Puppeteer installation and does not disclose this automatic pip installation behavior.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/svg2png.py:21

Finding

Untrusted SVG Rendering in Chromium with the Browser Sandbox Disabled

Content

View full analysis

Vulnerability Details

File Location: scripts/svg2png.py:21-39
Vulnerability Type: Unsafe active-content rendering and disabled browser sandbox
Risk Level: High

Vulnerable Code

javascript

const svgContent = readFileSync(resolve(svgPath), 'utf-8');

const m = svgContent.match(/viewBox\s*=\s*"([^"]+)"/);
if (!m) { console.error('No viewBox'); process.exit(1); }
const parts = m[1].split(/\s+/).map(Number);
const rW = Math.round(parts[2] * scale);
const rH = Math.round(parts[3] * scale);

const cleaned = svgContent
  .replace(/width="[^"]*"/, `width="${rW}"`)
  .replace(/style="[^"]*max-width[^"]*"/, '');

const html = `<!DOCTYPE html><html><head><meta charset="utf-8"><style>
  *{margin:0;padding:0}body{width:${rW}px}svg{display:block;width:${rW}px;height:${rH}px}
</style></head><body>${cleaned}</body></html>`;

const browser = await puppeteer.launch({ headless: true, args: ['--no-sandbox'] });
const page = await browser.newPage();
await page.setViewport({ width: rW, height: Math.min(rH, 16384), deviceScaleFactor: 1 });
await page.setContent(html, { waitUntil: 'networkidle0' });
await page.screenshot({ path: resolve(pngPath), fullPage: true });

Technical Analysis

The converter reads an arbitrary SVG file and directly interpolates its complete contents into an HTML document. It performs only two regular-expression replacements related to display width and does not parse or sanitize the SVG.

SVG is active content and can contain script elements, event handlers, foreignObject HTML, external resource references, and other browser-interpreted constructs. The converter does not reject these constructs or restrict network requests. Consequently, a crafted SVG may execute browser-side code or cause Chromium to request attacker-controlled resources during page.setContent().

The Chromium process is launched with --no-sandbox. This disables an important defense-in-depth boundary that normally limits the host impact of a browser rende ...[truncated 2290 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --no-sandbox and run Chromium with its standard sandbox enabled. Document any required host configuration rather than disabling this control.
2. Parse SVG as XML and enforce a strict allowlist of required elements and attributes before rendering.
3. Reject at minimum:
   • <script> elements
   • event-handler attributes such as onload and onclick
   • <foreignObject>
   • javascript: URLs
   • external href and xlink:href references
   • external CSS imports and remote url(...) values
   • unsafe XML declarations and external entities
4. Configure Puppeteer request interception to abort every network request not strictly required for the local document.
5. Render in a restricted container or dedicated low-privilege account with no secrets, minimal filesystem access, no unnecessary network access, and explicit CPU, memory, and execution-time limits.
6. Validate the viewBox values and scale before allocating rendering resources. Require finite, positive dimensions and enforce conservative maximum width, height, scale, and pixel-count limits.
7. Keep Chromium patched and pin a reviewed Puppeteer/Chromium version.
8. Add regression tests using SVG files containing scripts, event attributes, foreignObject, remote images, remote fonts, and oversized dimensions.
9. Revise the claim in SECURITY.md:3 that conversion performs no network requests; the current renderer does not enforce that property.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared purpose describes an end-to-end meeting-minutes generation skill: ingest meeting transcript-like inputs, structure/summarize them, produce an SVG card, and auto-convert to PNG. The actual code chunk implements only the final rendering utility: converting a preexisting SVG into PNG. While PNG conversion is mentioned in the description, the core declared functionality—processing meeting content into a structured SVG summary/card—is absent from this code. Therefore, the code's primary behavior is materially narrower and different from the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger guidance is overly broad, including generic requests like 'help me organize this meeting' or 'summarize this conversation,' which can cause the skill to activate on commonplace inputs containing sensitive business or personal content. Over-broad invocation increases the chance of processing data in contexts where the user did not intend this skill, especially when it writes files and invokes conversion tooling.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/svg2png.py (reported line 53)May include surrounding context.

python

subprocess.run(
            ['node', tmp.name, os.path.abspath(svg_path), os.path.abspath(png_path), str(scale)],
            check=True, timeout=60,
            env={**os.environ, 'NODE_PATH': '/tmp/node_modules'}
        )
    finally:
        os.unlink(tmp.name)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is explicitly designed to ingest meeting transcripts and generate SVG/PNG artifacts optimized for forwarding via chat platforms, but the README does not warn that transcripts may contain sensitive business, legal, HR, customer, or personal data. In this context, the omission increases the chance of accidental data exposure because users are encouraged to convert raw meeting content into easily shareable files without any privacy, retention, or redaction guidance.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly instructs the agent to use file I/O and run a shell command (python3 .../svg2png.py) but does not declare any tool scope or allowed-tools boundary. This creates an authorization gap where runtime capabilities exceed documented permissions, making unintended file access or command execution harder to review and constrain.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description and formatting rules are written as if the output is expected in Chinese, including constraints like '≤ 22 个中文字符' and Chinese UI/content conventions, but there is no indication that users can opt into another language. This creates a locale/language policy concern because the skill appears to enforce a specific language by default rather than offering a choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill handles meeting transcripts and produces shareable SVG/PNG artifacts, which commonly contain sensitive participant names, decisions, timelines, and business data. Failing to warn users about sensitivity and downstream sharing risk can lead to accidental disclosure when files are forwarded in chat tools or stored in insecure locations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file is composed entirely of Chinese natural-language labels and instructions, such as the title and task items, with no indication that the skill offers language selection or that it is explicitly limited to a Chinese-only regional context. Under the policy, fixed locale/language requirements without user opt-in or clear justification should be flagged.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/svg2png.py (reported line 50)May include surrounding context.

python

tmp.write(_PUPPETEER_SCRIPT)
    tmp.close()
    try:
        subprocess.run(
            ['node', tmp.name, os.path.abspath(svg_path), os.path.abspath(png_path), str(scale)],
            check=True, timeout=60,
            env={**os.environ, 'NODE_PATH': '/tmp/node_modules'}

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The code installs a Python package at runtime with pip, which introduces an unnecessary supply-chain and arbitrary-code-execution path during normal document conversion. If package indexes, dependency resolution, or the execution environment are compromised, attacker-controlled code could be installed and executed with the skill's privileges.

Content

Scanner excerpt · scripts/svg2png.py (reported line 75)May include surrounding context.

python

try:
        import cairosvg
    except ImportError:
        subprocess.check_call([sys.executable, "-m", "pip", "install",
                               "--break-system-packages", "-q", "cairosvg"])
        import cairosvg
    cairosvg.svg2png(url=svg_path, write_to=png_path, scale=scale)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Dynamically installing cairosvg during execution is not necessary for the skill's business logic and expands the trust boundary to package repositories and transitive dependencies at runtime. That creates a realistic supply-chain risk and makes behavior non-deterministic across executions and environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The markdown embeds an external image hosted on raw.githubusercontent.com, which causes a network request when the documentation is rendered. Because the skill handles potentially sensitive meeting transcripts, the documentation should clearly disclose any external-resource loading or privacy considerations in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The visible text throughout the SVG is entirely in Chinese, presenting the content in a single language without any indication of optional locale selection or user opt-in. Under the policy rule for natural-language violations, forcing a specific language can be a locale policy issue when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This file presents all user-facing content in Chinese, including titles, steps, and risk notes, but does not indicate that the skill is region-specific or provide any user opt-in for language/locale selection. That can conflict with language/locale policy requirements for skills expected to support broader audiences.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file explicitly sets the text font stack to Chinese-oriented fonts ('Microsoft YaHei', 'PingFang SC'), and all visible content is in Chinese, which indicates a fixed locale presentation. Under the policy rule, forcing a specific language/locale without user opt-in can be a natural-language policy violation when no alternative or opt-in is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.