Room Status Query

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

This skill is a simple meeting-room status lookup, but it is marked for Review because it tells the agent to show employee names and meeting subjects for released rooms.

Review this skill before installing in environments where meeting subjects or employee names are sensitive. It should be limited to authorized users and, for ordinary availability checks, should ideally show only room, location, capacity/equipment, and release time unless there is a clear business need to expose booker and subject.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:55

Finding

Potential Unauthorized Disclosure of Meeting Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-76 and SKILL.md:112-120
Vulnerability Type: Missing authorization and data-minimization requirements
Risk Level: Medium

Evidence

text

GET /api/rooms/released

json

{
  "code": 0,
  "data": {
    "total": 2,
    "list": [
      {
        "id": 2807122,
        "room_id": 16795,
        "room_name": "4F Meeting Room 4",
        "area_name": "Oriental Electronic Technology Building",
        "city_name": "Beijing",
        "start_time": 1780563601000,
        "end_time": 1780567200000,
        "booker_username": "Employee Name",
        "subject": "Meeting"
      }
    ]
  }
}

text

Group the results by city and office area and display a table for each office area:

| Meeting room | Booker | Meeting subject | Release time |
|--------------|--------|-----------------|--------------|
| 4F Meeting Room 4 | Employee Name | Meeting | 11:00 |

Technical Analysis

The Skill instructs the agent to retrieve recently released meeting-room records and present both booker_username and subject to the requesting user. These fields can contain employee identity information and confidential business context, but they are not necessary to answer whether a meeting room has become available.

The Skill does not require authentication, requester authorization, role validation, scope checks, consent verification, or redaction before disclosing these fields. Although server-side behavior cannot be verified from the reviewed file, the documented workflow would expose the metadata whenever the API makes it available to the agent. Authorization must be enforced by the server and explicitly preserved by the Skill rather than being inferred from access to the endpoint.

Attack Path

1. A user asks the agent which meeting rooms were recently released.
2. The Skill directs the agent to call `GET https://smartr ...[truncated 1176 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove booker_username and subject from user-facing output. Return only the room name, location, capacity, equipment, and release time needed for availability queries.
2. Modify the API response schema so /api/rooms/released does not return personal or confidential meeting fields to ordinary room-query clients.
3. Require authenticated access and enforce authorization server-side using least-privilege roles and office-location scopes.
4. Do not treat possession of an endpoint URL, network access, or successful authentication as authorization to view all booking metadata.
5. If business requirements require these fields, restrict them to explicitly approved roles and document the applicable purpose and retention policy.
6. Apply field-level redaction before data reaches the agent. Avoid relying solely on prompt instructions to suppress sensitive fields.
7. Add audit logging and monitoring for repeated or bulk requests to the released-room endpoint.
8. Add tests confirming that unauthorized users cannot retrieve organizer identities or meeting subjects and that the Skill never renders those fields for ordinary availability requests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.