T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tencent_meeting_export.py:428- Finding
Destination Validation Does Not Prevent Navigation to Arbitrary URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Tencent Meeting Export
Security checks for vulnerabilities and agentic risk
Overview
The skill appears intended to export Tencent Meeting transcripts, but it needs review because it can launch a browser against arbitrary URLs while saving potentially sensitive meeting content locally.
Install only if you are comfortable running a local Chromium browser and saving meeting transcripts on disk. Use only Tencent Meeting share links you are authorized to access, avoid passing arbitrary URLs, and treat exported Markdown or JSON as sensitive meeting records. Prefer running it in an isolated environment and pinning reviewed Playwright dependencies.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
SKILL.md:20- Finding
Playwright and Chromium Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents and encourages writing exported transcript data to local files, but it does not declare any explicit tool scope or permissions boundary for file-writing behavior. This matters because meeting transcripts, summaries, speaker names, and event timelines can contain sensitive personal or business information, so undeclared write capability weakens user awareness and sandboxing expectations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill promotes exporting full meeting transcripts from public share links but omits a warning that the resulting data may include sensitive personal, corporate, or regulated information even when the link is public. Users may incorrectly assume that 'public share' means low-risk data handling, leading to unintended disclosure, redistribution, or insecure storage of names, speech content, summaries, and participation events.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The script captures and writes potentially sensitive meeting artifacts—full transcripts, speaker identities, summaries, chapters, and event nodes—to local Markdown/JSON files without any privacy warning, consent check, or safer default handling. In the context of meeting recordings, this increases the risk of unauthorized retention, accidental sharing, and exposure of confidential business or personal information.
- Content
Dynamic attribute access via getattr()
Low
- Category
- Dangerous Code Execution
- Confidence
- 50% confidence
- Finding
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
- Content
python # 分发到对应的处理器 for pattern, handler_name in self.API_PATTERNS.items(): if pattern in url: getattr(self, handler_name)(data) break except Exception: pass
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Playwright browser context is configured with locale="zh-CN", which imposes a specific locale behavior. Under the policy, locale constraints should be optional or clearly justified; this file does not provide a user opt-in or explanation that the tool is limited to Chinese locale operation.
- Content