高效会议流程管理助手

• Outcome: Review
• Latest audit: Sep 3, 2026 · 9:00 AM UTC
• Version: 1.0.3

Overview

This meeting automation skill is not malicious, but it needs Review because it can automatically use calendars, meeting records, documents, notifications, and persistent TODO data with broad triggers and limited consent controls.

Install only if you are comfortable with an agent using configured calendar, document, meeting-platform, and messaging tools for end-to-end meeting workflows. Before enabling adapters, restrict API scopes, avoid broad meeting-recording access, review recipients before notifications are sent, and treat TODO reminders or daily scans as opt-in persistent behavior.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The trigger language is extremely broad and instructs activation even when users merely mention generic meeting-related concepts. In an agent environment, this can cause unintended invocation of actions touching calendars, notes, recordings, or notifications without sufficiently clear user intent, increasing the risk of over-collection and over-action.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The skill declares an absolute requirement to check busy/free status before scheduling, but elsewhere permits skipping conflict validation when no calendar adapter is configured and still proceeding with schedule creation/manual creation output. That contradiction can cause the agent to generate or encourage conflicting bookings despite a stated safety invariant, making the workflow unreliable and potentially disruptive in real organizational calendars.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill mandates escalating partial requests like 'book a room' into a full end-to-end workflow, including scheduling, materials, and follow-on steps. This violates least surprise and can lead the agent to access or generate additional data, contact attendees, or create artifacts beyond what the user requested.

Credential Access

High

• Category: Privilege Escalation

Content

"_comment": "这是示例配置。请复制为 adapters.json 后按自己的工具填写。\"none\" 表示不使用该适配器，对应步骤将降级为手动模式。",
  "calendar": {
    "provider": "google",
    "credentials": "path/to/google-credentials.json"
  },
  "transcription": {
    "provider": "whisper",

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The example invocation at this line uses broad natural-language phrasing that can overlap with ordinary user requests, increasing the chance that the skill auto-triggers in situations the user did not explicitly intend. In an agent environment, over-broad triggers can cause inappropriate activation of scheduling, note-processing, or follow-up flows, which may expose meeting data to connected tools or create unintended actions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes access to attendee busy/free status, meeting records/transcripts, and post-meeting notifications, but the README does not clearly warn users that these operations may expose sensitive scheduling metadata and confidential meeting content. In a meeting-orchestration skill, this omission matters because users may enable adapters or provide transcripts without understanding consent, least-privilege, retention, and recipient-scope risks.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest description at L005 says pure task management is out of scope unless it is meeting-related. But L195-L199 define a TODO pool with generic commands such as '看TODO', 'XX做完了', and '记一下XX', which enable general task management behavior without requiring a meeting context. That broadens the behavior beyond the stated meeting-only scope.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill describes multiple external integrations but does not clearly warn users that calendar contents, meeting metadata, transcripts, documents, and notification payloads may be accessed and transmitted across third-party services. Lack of transparent disclosure undermines informed consent and increases the chance of inappropriate handling of sensitive business information.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: Automatically pulling unfinished TODOs from prior meeting records into new materials creates a cross-context data disclosure path without a fresh user request or attendee-based access check. This can expose sensitive action items, names, deadlines, or project details to a different meeting context where not all participants should see them.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The meeting adapter explicitly supports retrieving historical meeting records, recordings, and subtitles from external platforms, but the contract lacks any privacy, consent, retention, or authorization guardrails. Because meeting recordings and transcripts often contain sensitive business or personal data, omission of these checks can enable overcollection or unauthorized processing if an agent is connected to broad-scope APIs.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The rule '自动执行降级，不询问用户' means the agent may continue workflow actions after a tool failure or missing configuration without obtaining renewed user consent. In a meeting-management skill, this can lead to unintended scheduling, messaging, or data handling behavior under degraded assumptions, increasing the risk of incorrect actions and user-surprising side effects.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This file presents all instructions and templates exclusively in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which appears here.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill specifies proactive notifications, deadline reminders, and daily scans that imply ongoing monitoring and outbound messaging, but it does not clearly require explicit user consent, disclosure of monitoring scope, or controls for recipients and cadence. In a meeting workflow context, this can lead to unexpected surveillance-like behavior, leakage of task/status information to participants, and processing outside the user's immediate request context.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Requiring completion evidence such as document links, screenshot descriptions, or result summaries can cause users to submit sensitive internal data, but the design does not explain sensitivity handling, storage duration, access controls, or minimization. In a meeting assistant, these artifacts may contain confidential business information, personal data, or links to restricted systems, creating avoidable privacy and data retention risk.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: All invocation examples are written only in Chinese in this file, and the skill title and usage guidance present Chinese as the expected operating language without an explicit opt-in or note that other languages are supported. Under the policy, locale constraints should either offer user choice or be clearly documented as intentional and justified.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The onboarding flow writes adapter selections into a local configuration file without clearly disclosing that persistent configuration data will be stored. While low severity, undisclosed local writes can surprise users and create governance issues in managed or shared environments.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The top-level comment is written entirely in Chinese and provides key usage instructions for the configuration file. Because this file contains operational guidance and does not offer an alternative language or indicate that the skill is intentionally Chinese-only, it creates a language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The document is initialized with `lang='zh'` and `applyLang('zh')`, so users are shown Chinese by default even though bilingual content exists. This can be considered a locale preference being imposed unless the user explicitly chooses it or the regional restriction is documented.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The entire file is written as Chinese-only operational guidance, including fixed Chinese user-facing text such as the room-borrowing template, with no indication that users can choose another language. This can violate a language-choice policy when the skill is intended for general use rather than a clearly documented China-specific context.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.