腾讯会议冲突检查

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for checking Tencent Meeting conflicts and running a disclosed watcher, with privacy and supply-chain caveats users should understand.

Install only if you are comfortable letting the skill read meeting metadata visible to your Tencent Meeting account and store local watcher state. Prefer pinning reviewed dependency versions before installation, and enable the watcher or Task Scheduler only when you intentionally want background conflict checks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/windows-execution.md:14

Finding

Unpinned Third-Party Dependencies Permit Mutable Installation Results

Content

View full analysis

Vulnerability Details

File Location: references/windows-execution.md:14-16, scripts/requirements.txt:1-3
Vulnerability Type: Unpinned third-party dependencies and non-reproducible installation
Risk Level: Medium

Complete Code Snippets:

powershell

npm install -g @tencentcloud/tmeet@latest
tmeet.cmd -V
py -3 -m pip install -r ".\scripts\requirements.txt"

text

# CPython on Windows does not ship an IANA time-zone database. This package is
# only needed there when --timezone uses names such as Asia/Shanghai.
tzdata>=2024.1; platform_system == "Windows"

Technical Analysis

The installation procedure explicitly requests the mutable @latest version of the Tencent Meeting npm package. The Python requirement also accepts any tzdata release at or above version 2024.1. No lockfile, exact version, package hash, or integrity-verification mechanism is provided.

Consequently, following the same documented installation procedure at different times can install different code. A compromised package release, registry account, distribution artifact, or unexpectedly incompatible future version could execute during installation or change the behavior of the authenticated meeting CLI.

The package name is an official-looking scoped npm package, and the audit found no evidence that the currently published dependency is malicious. The issue is the absence of reproducible version and integrity controls rather than evidence of an existing malicious payload.

Attack Path

1. A user follows the documented Windows installation instructions.
2. npm resolves @tencentcloud/tmeet@latest, while pip resolves any available tzdata version satisfying >=2024.1.
3. A malicious or compromised future release is selected because no reviewed version is pinned.
4. Package installation code or modified runtime components execute with the installing user's privileges.
5. A compromised CLI could affect ...[truncated 743 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @tencentcloud/tmeet@latest with an exact, reviewed version.
2. Pin tzdata to an exact reviewed version instead of using an open-ended lower bound.
3. Add and retain appropriate lockfiles so dependency resolution is reproducible.
4. For Python installations, use a hash-locked requirements file and install with pip --require-hashes.
5. Verify npm package integrity through a controlled lockfile and trusted registry configuration.
6. Introduce a documented dependency-update process that reviews release notes, package ownership, lifecycle scripts, checksums, and behavior before changing pinned versions.
7. Run installation and the CLI under a non-administrative account with only the permissions required for meeting conflict checks.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell commands and references local files/scripts, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch weakens least-privilege controls because a host may permit broader shell or filesystem access than users and reviewers expect, increasing the blast radius if the skill is modified, misused, or prompt-injected into running unintended commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill content presented to users is entirely in Chinese, including required user-facing output text, but there is no indication that the user may choose another language or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L132 prescribes exact Chinese phrasing that must appear at the end of every user-visible result, making the skill enforce a specific language for responses. The file does not offer the user a language choice or describe this as a justified region-specific constraint, so it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is entirely written in Chinese and presents operational instructions without offering an alternative language or stating that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/watch_meeting_conflicts.py (reported line 278)May include surrounding context.

python

resolved_command = [executable, *command[1:]]
    windows_batch = needs_windows_batch_shell(executable)
    try:
        completed = subprocess.run(
            resolved_command,
            check=False,
            capture_output=True,

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/watch_meeting_conflicts.py (reported line 563)May include surrounding context.

python

synchronize = 0x00100000
    wait_object_0 = 0x00000000
    wait_timeout = 0x00000102
    wait_failed = 0xFFFFFFFF
    error_access_denied = 5
    error_invalid_parameter = 87

Static analysis

No suspicious patterns detected.