Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed meeting-brief generator, with the main caution that it may handle sensitive meeting materials and optionally sync output to Tencent Docs.
Install only if you are comfortable letting the skill process meeting context and user-supplied files for a meeting brief. Use Tencent Docs sync only for material that can be stored in that service, and review generated briefs before sharing because the skill is designed for internal meeting preparation.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</head>
<body>
<div class="container">
<!-- Header -->
<!-- Section 1..N -->
<!-- Footer -->
</div>
The README states that the skill performs web research and can sync output to Tencent Docs, but it does not disclose that meeting details and attached documents may be transmitted to external services. In a meeting-preparation context, inputs commonly contain sensitive business information, so omission of data-flow warnings can lead to unintended disclosure of confidential material.
All user-facing instructions, examples, and prompt templates are presented only in Chinese, and the usage guidance assumes Chinese prompts without mentioning any language options. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill is documented to auto-trigger on very broad phrases like '会议准备', 'meeting prep', and '会议摘要', which can overlap with ordinary conversation and cause the agent to invoke the skill when the user did not intend to start a structured document-generation workflow. In this context, accidental invocation could lead to unnecessary processing of attached files, unintended use of external integrations such as Tencent Docs, or disclosure of sensitive meeting context into the skill pipeline.
The skill description includes broad triggers like meeting prep, briefing, and meeting summary without clear boundaries on when the skill should or should not activate. This can cause the agent to invoke the skill for generic meeting-related requests, unnecessarily expanding its authority to fetch, parse, and compile potentially sensitive data from user files and web sources.
The HTML declares lang="zh-CN", and the visible UI text throughout the template is fixed in Chinese, indicating the skill output is constrained to a specific language/locale. There is no accompanying natural-language indication that this locale is optional, user-selected, or required for a region-specific use case.
The file is written entirely in Chinese and the template explicitly sets the HTML language to zh-CN, which indicates a fixed language/locale choice. There is no statement that the skill is China-specific or that users may opt into another language, so this appears to violate the language/locale policy requirement.
The natural-language description and trigger examples are entirely in Chinese, and the README presents the skill as being invoked through Chinese phrasing without mentioning any language options. This can be a locale/language policy issue when no user opt-in or alternative language support is documented.
The usage guidance relies on vague keyword-based activation such as briefing or meeting preparation, which is insufficiently constrained by task intent or output type. In practice, this can lead to accidental invocation on loosely related prompts, increasing the chance of over-collection of context or unnecessary use of research and document-processing capabilities.
No suspicious patterns detected.