tencent-meeting-ingest

• Outcome: Pass
• Latest audit: Aug 7, 2026 · 4:49 PM UTC
• Version: 1.0.14

Overview

This skill does what it claims: it fetches Tencent Meeting material through a sibling skill and writes meeting-derived pages into a configured Gitea knowledge base.

Install only in an environment where the Tencent Meeting command is trusted and the Gitea bot token is limited to the intended KB repository. Expect meeting transcripts and minutes to be archived into that repository and limited context to remain in the shared work directory for retry support.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not command:
        raise RuntimeError("外部 skill 命令未配置")
    args = shlex.split(command) + list(extra_args or [])
    completed = subprocess.run(
        args,
        text=True,
        encoding="utf-8",

• Confidence: 84% confidence
• Finding: The code executes an external command derived from a configurable string (`command`) plus additional arguments, with no allowlist, path restriction, or trust boundary enforcement. Although `subprocess.run` is invoked without `shell=True`, this still permits execution of arbitrary binaries if an attacker can influence the configured command or related inputs, which is especially sensitive in a skill-bridging component designed to call sibling skills.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill describes significant capabilities including environment variable access, local file read/write, shell execution, network access, and repository modification, yet it declares no explicit permissions boundary. That creates a real security risk because operators and upstream tooling cannot clearly constrain or review what the skill is allowed to do before it fetches external data and writes to Gitea.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This module is not limited to Tencent Meeting ingestion; it contains generic repository maintenance capabilities, including arbitrary file upserts plus catalog and index mutation. In a skill whose purpose is ingesting meeting artifacts, this expands the effective authority to broader KB modification, increasing the chance of unintended or unauthorized content changes if upstream inputs or orchestration are compromised.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The exposed read_text, exists, upsert_text, and upsert_bytes methods accept caller-controlled paths and perform reads/writes anywhere in the configured repository. Without path-level authorization or namespace enforcement, any component invoking this client can modify unrelated KB content, overwrite important files, or exfiltrate repository data beyond Tencent Meeting artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The bridge allows the executable command to be sourced directly from environment variables and then invokes it via an external command runner. Even though this may be intended for flexible integration with a sibling Tencent Meeting skill, it creates a command-execution trust boundary where anyone who can influence the environment or deployment configuration can redirect the bridge to run arbitrary code under the agent's privileges.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly relies on sensitive credentials and performs outbound Tencent Meeting retrieval plus write operations to Gitea, but it does not present a clear user-facing warning about data transmission, archival of meeting content, and repository modification. This is dangerous because meeting transcripts and minutes may contain sensitive internal information, and users may not understand that the skill will persist and publish that content into a knowledge base.

Missing User Warnings

Medium

• Confidence: 76% confidence
• Finding: This code launches an external subprocess silently, without any user-visible confirmation, audit prompt, or policy gate at the execution point. In the context of a KB ingestion skill that delegates work to another skill, this increases the risk of unexpected external actions or privilege abuse if the bridge is triggered with attacker-controlled configuration or if operators are unaware that local command execution occurs.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: Repository writes occur immediately when these methods are called, with no built-in confirmation, audit prompt, or user-visible warning. In an agent skill context, silent write side effects are risky because a user may believe the tool is only ingesting data while it is also persisting changes to a shared KB repository.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.