Security audit

腾讯会议

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Tencent Meeting connector that can manage meetings and access meeting content with the user's Tencent token, and I found no hidden exfiltration or deceptive behavior.

Install only if you intend to let this skill use your Tencent Meeting token to read meeting data and perform meeting actions. Review confirmations carefully for cancellations, invitee replacement, recording permission requests, meeting calls, and kicks; meeting recordings and transcripts may contain sensitive business or personal information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill declares no explicit permissions while its documented behavior requires environment access, local file persistence, and network communication. This weakens least-privilege controls and informed consent, because operators may not realize the skill can read tokens, write local state, and contact remote services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose omits materially important behaviors: persistent local state in ~/.tencent-meeting-mcp/update-state.json, overwriting _client_info.os with the real local OS, and especially generic proxying of arbitrary MCP methods to a configured base URL. That last behavior can expand the skill beyond its stated Tencent Meeting scope, enabling unreviewed remote method access and unexpected data exposure.

Context-Inappropriate Capability

Low

Confidence: 85% confidence
Finding: The code overwrites any provided _client_info.os value with the host system's real OS name and then forwards it downstream. This is unnecessary for the stated meeting-management purpose and creates avoidable host fingerprinting/data disclosure, especially because the collection is implicit and not user-driven.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill description prominently promotes access to recordings, transcripts, and AI minutes but does not clearly warn that these features can expose highly sensitive meeting content. In a conferencing context, such content may include confidential business discussions and personal data, so the lack of explicit disclosure makes misuse and accidental access more dangerous.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill description prominently promotes access to recordings, transcripts, and AI minutes but does not clearly warn that these features can expose highly sensitive meeting content. In a conferencing context, such content may include confidential business discussions and personal data, so the lack of explicit disclosure makes misuse and accidental access more dangerous.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The dictionary states that `meeting_invitees_replace` with an empty array will clear all invitees, but the warning is buried in a note rather than enforced as a mandatory confirmation rule at the skill level. In a meeting-management context, this can cause unintended mass removal of invitees through ambiguous user input, agent misunderstanding, or prompt manipulation, disrupting meetings and communications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.