Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Tencent Meeting recording workflow that handles sensitive meeting content but includes clear user-control and privacy guardrails.
Install only if you intend to let the agent work with Tencent Meeting recordings and transcripts available through your tmeet login. Be careful with playback/download links because they may contain temporary credentials, and review permission-apply confirmations before approving any real access request.
The skill is written entirely in Chinese and specifies user-facing output structure in Chinese, but it does not state that language choice is optional or user-selected. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly justified.
The default activation prompt is very broad and encourages the agent to invoke a powerful recording/transcript workflow whenever a user mentions related topics, without requiring explicit confirmation, scope limits, or authorization checks. In a skill that can access meeting recordings, summaries, transcripts, and access-request handling, overly permissive triggering increases the chance of unintended data retrieval or disclosure from sensitive corporate meetings.
No suspicious patterns detected.
