meeting-deep-process

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:18 PM UTC
• Version: 1.0.3

Overview

The skill has a coherent meeting-analysis purpose, but it needs Review because it combines sensitive participant profiling, real-time monitoring, broad CLI authority, and some manipulative strategy examples without enough consent and scoping controls.

Install only after reviewing the Review concerns. Use it for authorized meetings where participants understand that transcripts may be analyzed and people may be profiled over time. Prefer a pinned, isolated, read-only tmeet integration; do not let the agent use meeting admin commands from the bundled CLI reference. Avoid using inferred profiles for hiring, discipline, compensation, or other high-stakes decisions without independent review, and remove or revise the deceptive negotiation examples before operational use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/tmeet-cli-reference.md:8
• Finding: Unpinned Global Installation of a Mutable Third-Party Package<![CDATA[ ## Vulnerability Details **File Location**: `references/tmeet-cli-reference.md:8-12` **Vulnerability Type**: Unpinned global npm dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ### Installation ```bash npm install -g @tencentcloud/tmeet@latest ``` ``` ### Technical Analysis The Skill instructs the Agent to install `@tencentcloud/tmeet` globally using the mutable `latest` distribution tag. No exact version, integrity hash, lockfile, package provenance check, or reviewed dependency manifest is provided. Consequently, the code installed during a future Skill invocation may differ from the package version that existed when the Skill was audited. Global installation also expands the impact beyond an isolated project environment. Depending on the host's npm configuration and user privileges, package lifecycle scripts and installed executables may run with access to the user's files, environment variables, authentication state, and network. The package namespace appears consistent with Tencent Cloud, and the audit found no evidence that the referenced package is currently malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition method. ### Attack Path 1. An attacker compromises the package publisher, registry account, release pipeline, or one of the package's transitive dependencies. 2. A modified release is assigned to the `latest` npm tag. 3. The Skill invokes or recommends: ```bash npm install -g @tencentcloud/tmeet@latest ``` 4. npm downloads the modified package and may execute its lifecycle scripts. 5. The globally installed CLI subsequently runs with the user's access to meeting authentication and local resources. 6. Malicious package code can access or transmit data available to the CLI process. ### Impact Assessment Successful exploitation could affect: - Local files accessible to the user running npm. - Environment variables and other process-accessible secrets. - Tencent ...[truncated 478 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact version: ```bash npm install --global --ignore-scripts @tencentcloud/tmeet@<reviewed-exact-version> ``` 2. Verify package provenance, publisher identity, registry origin, and integrity before installation. 3. Provide a lockfile or integrity digest for the approved package and its transitive dependency tree. 4. Prefer a project-local or isolated installation rather than a global installation. 5. Run the CLI under a dedicated, least-privileged account or sandbox with access only to required meeting data. 6. Disable npm lifecycle scripts where compatible, and separately review any scripts required for installation. 7. Require explicit user approval before installing software. 8. Establish a dependency update process in which each new version is reviewed before the pinned version is changed. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/tmeet-cli-reference.md:103
• Finding: Overprivileged CLI Reference Exposes Destructive Meeting Operations Without a Consistent Consent Boundary<![CDATA[ ## Vulnerability Details **File Location**: `references/tmeet-cli-reference.md:103-106` **Additional Locations**: `references/tmeet-cli-reference.md:174-177`, `355-369`, `388-391`; `SKILL.md:104`, `168` **Vulnerability Type**: Excessive operational privileges in a data-retrieval fallback **Risk Level**: Medium ### Vulnerable Code The CLI reference includes meeting cancellation: ```bash tmeet meeting cancel --meeting-id "100000000" tmeet meeting cancel --meeting-id "100000000" --sub-meeting-id "200000001" # Cancel a child meeting tmeet meeting cancel --meeting-id "100000000" --meeting-type 1 # Cancel the entire recurring meeting ``` It also exposes invitee mutation: ```bash tmeet meeting invitees-add --meeting-id "100000000" --invitees "id1,id2" tmeet meeting invitees-remove --meeting-id "100000000" --invitees "id1,id2" tmeet meeting invitees-replace --meeting-id "100000000" --invitees "id1,id2,id3" ``` Participant-control operations are included: ```bash tmeet control call --meeting-id "100000000" --users "id1,id2" ``` ```bash tmeet control kick --meeting-id "100000000" --users "id1,id2" tmeet control kick --meeting-id "100000000" --users "id1" --sip-users "ms1" --pstn-users "mp1" tmeet control kick --meeting-id "100000000" --allow-rejoin --users "id1" ``` The reference also permits diagnostic-log upload: ```bash tmeet tshoot log tmeet tshoot log --start "..." --end "..." tmeet tshoot log --upload ``` ### Technical Analysis `SKILL.md` characterizes the bundled CLI reference as a fallback data channel for obtaining meeting data when a dedicated meeting data-source Skill is unavailable. The documented analysis workflow only requires read-oriented operations such as listing meetings, retrieving meeting details, reading recordings and transcripts, and obtaining participant reports. However, the fallback reference also provides unrelated state-changing capabilities: - Cancelling meetings, including entire recurring meeting ...[truncated 2378 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the bundled fallback reference with a strict read-only command allowlist limited to: - `meeting list` - `meeting list-ended` - `meeting get` - `record list` - `record address` - `record smart-minutes` - `record transcript-get` - `record transcript-paragraphs` - `record transcript-search` - `report participants` 2. Remove cancellation, meeting updates, invitee mutation, participant control, permission changes, feedback submission, and log-upload commands from this Skill. 3. Move state-changing meeting administration commands into a separate, explicitly invoked administration Skill. 4. Require fresh, explicit user confirmation immediately before every external side effect. Confirmation should identify the exact meeting, participants, operation, and expected effect. 5. Never infer authorization merely because the CLI is authenticated. 6. Enforce command allowlisting in code or tool policy rather than relying only on prose instructions. 7. Treat meeting transcripts, minutes, metadata, and retrieved documents as untrusted data that cannot authorize tool calls. 8. For diagnostic uploads, display the files and data categories to be uploaded, redact secrets and personal information, and obtain explicit consent. 9. Use a dedicated read-only API credential or role where the platform supports scoped authorization. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (34)

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The finding is valid because the document’s body recommends tactics that exploit inferred weaknesses and disguise negotiation intent, including using the counterpart’s technical blind spots to build asymmetric leverage and '伪装' escalation or pauses as tactical devices. In the context of a profiling-driven negotiation skill, these instructions undermine the later ethics disclaimer and can normalize manipulative conduct while relying on behavioral inferences about a named target persona.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: This is a true issue: the '触发点规避' section explicitly suggests creating the feeling that the other side’s concession was rewarded even when there is no substantive acceptance, and recommends disguising a superior-approval delay as a break. Those are manipulative interaction patterns that conflict with the stated prohibition on manipulation and can mislead participants about the real state of agreement and authority.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The D04 section describes single-meeting and cumulative 12-dimensional speaker profiling, cross-meeting aggregation, difference analysis, evolution tracking, and personalized strategy generation without warning that the system is inferring personal attributes over time. This is especially risky because persistent profiling across meetings can enable covert behavioral surveillance, unfair evaluation, and sensitive inference about employees or candidates, amplifying harm beyond ordinary note-taking.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list contains broad generic phrases like meeting analysis, transcript analysis, and meeting notes, making accidental invocation likely during ordinary collaboration tasks. Over-broad activation is risky here because the skill performs deep participant profiling and potentially accesses sensitive meeting data, so unintended use could expose private content or generate unwanted inferences.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description emphasizes analysis and enhancement features but does not clearly warn users that it may process sensitive meeting content and generate participant profiles, relationship inferences, and behavioral assessments. In this context, lack of upfront disclosure is dangerous because users may submit confidential recordings or transcripts without understanding the privacy and consent implications.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill claims to be platform-agnostic and not to directly call platform commands, yet documents a fallback path that uses a specific local `tmeet` CLI to fetch meeting data. This mismatch can mislead users and reviewers about actual data-access behavior, increasing the risk of unauthorized local command usage and unexpected access to sensitive meeting recordings or transcripts.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly states that the skill does not directly call platform commands, but later instructs use of the `tmeet` CLI as a fallback. In a security-sensitive agent environment, contradictory statements about command execution are dangerous because they undermine trust boundaries and may cause operators to approve a skill under false assumptions about its capabilities.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The privacy statement says profiling is limited to publicly expressed meeting information, but the 12-dimensional model includes sensitive or inferential categories such as identity, culture, hierarchy, motivation, and relationships that can extend beyond what participants reasonably expect from meeting analysis. Even if derived only from speech, these inferences can produce sensitive personal profiling and create privacy, fairness, and misuse risks.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all instructions, labels, and user guidance only in Chinese. Under the language/locale policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: 该技能范本的自然语言内容整体固定为中文，标题和全文均以中文撰写，且未见向用户提供语言/地区选择或说明仅适用于特定中文场景。按规则，若技能强制特定语言且无用户选择或明确正当化，属于语言/locale 政策风险。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The exemplar normalizes detailed analysis of identifiable meeting participants using sensitive behavioral inferences, including confidence, hierarchy effects, willingness, confusion, and nonverbal signals such as facial expressions, note-taking, and phone checking, without any warning, consent boundary, or privacy safeguard. In a meeting-analysis skill, this omission is risky because downstream users may treat these inferences as acceptable defaults and apply them to real employees, creating privacy, profiling, and workplace surveillance harms.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template explicitly recommends permanent retention, full preservation of video/transcript/PPT, and broad access for the technical team, but it does not require any privacy, consent, retention-policy, or data-classification checks before doing so. In a meeting-processing skill, this can normalize over-retention of potentially sensitive recordings and transcripts, increasing exposure of personal data, confidential business discussions, and regulated information.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown exemplar is entirely written as a fixed Chinese report template, including required section headings, field labels, and narrative style, with no indication that users may choose another language. Under the policy, language-specific behavior is a violation unless the skill explicitly offers opt-in or clearly documents a justified region-specific constraint.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This file presents all instructions and operational content only in Chinese, with no indication that the skill is region-specific or that users can choose another language.

Ssd 1

Medium

• Confidence: 95% confidence
• Finding: The text recommends hypothetical framing specifically because it '绕过了防线' of a compliance-minded stakeholder, which is direct guidance for circumventing a person's normal protective or authority-based defenses. That crosses from neutral communication coaching into adversarial social engineering methodology, especially because it links phrasing style to defeating a known human control behavior.

Ssd 4

Medium

• Confidence: 93% confidence
• Finding: The exemplar explicitly teaches an operator how to overcome a participant's resistance and authority boundaries by changing timing, sequencing, and wording to reduce the chance of interruption or rejection. Even in a meeting-optimization context, this normalizes manipulative influence tactics that can be reused to steer decisions, suppress authentic objections, or bypass informed consent in workplace or governance settings.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The exemplar explicitly states that the engine connects to a real-time meeting transcription stream via websocket and performs live monitoring of participant behavior, but it provides no visible warning, consent requirements, retention limits, or data-handling safeguards. Because meeting transcripts can contain sensitive business, personnel, legal, or security information, normalizing this collection pattern without privacy controls increases the risk of unauthorized surveillance, over-collection, and downstream leakage.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: This markdown file presents all instructions, labels, and example outputs exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This markdown exemplar presents all instructions and content in a single language with no user opt-in, alternative locale, or stated region-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The entire skill file is written exclusively in Chinese and provides no indication that users may choose another language or that the locale restriction is required for a specific region-bound compliance or operational purpose. Under the policy for natural-language violations, forcing a specific language without opt-in is reportable.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This exemplar explicitly encourages detailed personal profiling across 12 dimensions, including relationship, hierarchy, ability, motivation, and dynamic behavioral inference, but provides no privacy, consent, fairness, or use-limitation warning. In the context of a meeting-analysis skill, that omission makes it easier for downstream users or agents to over-interpret conversational data into sensitive judgments about real people, creating profiling and misuse risk.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The content assigns quantified internal motives such as "权力驱动(60%) + 利益驱动(40%)" to a named individual based only on meeting dialogue, which presents speculative psychological inference as if it were measured. In a meeting-processing skill, this is especially risky because it can be reused to generate authoritative-sounding personality judgments about employees or participants without consent, validation, or contextual limitation.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The entire skill exemplar is written as a Chinese-only report template and does not indicate that users may choose another language or locale. Under the policy, language constraints should either be optional or explicitly justified; this file presents a fixed language format without such opt-in or justification.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The catalog explicitly describes passive meeting attendance, pre-meeting context loading, post-meeting archiving, and cross-recording analysis, but provides no requirement for notice, consent, or lawful basis before processing recordings and participant data. In a meeting-analysis skill, that omission is dangerous because users may deploy it on sensitive conversations without informing participants, creating privacy, compliance, and workplace-surveillance risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The catalog includes real-time transcript-stream processing and live intervention capabilities, including monitoring discussion depth and intervening during meetings, but does not warn that participants should know such live monitoring is occurring. In context, real-time invisible analysis is more dangerous than offline summarization because it can shape ongoing behavior, influence outcomes, and normalize undisclosed surveillance in sensitive group settings.

Static analysis

No suspicious patterns detected.