T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:25- Finding
Skill Instructions Attempt to Override the Agent’s Instruction Hierarchy and Interrupt User Tasks
- Content
View full analysis
- Remediation
View remediation
Security audit
腾讯会议
Security checks for vulnerabilities and agentic risk
Overview
This Tencent Meeting skill is mostly purpose-aligned, but its automatic update-install flow and instruction-priority claims need human review before installation.
Review before installing. This skill can manage Tencent meetings, read meeting-derived content, use enterprise contacts for meeting actions, and change participants, so use it only with a Tencent Meeting token you intend to grant those abilities. Pay special attention to the update settings: avoid enabling auto-upgrade unless you trust the remote update channel, because the artifact instructs the agent to install from a server-provided address without visible signature or checksum verification.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/version_management.md:18- Finding
Remote Update Instructions Permit Installation from a Dynamically Supplied Address
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Reading host files such as /etc/os-release for OS detection and version fingerprinting is unrelated to the stated Tencent Meeting functionality and expands local system visibility without clear need. Even limited fingerprinting can aid environment profiling and violates the principle of least surprise when not disclosed in the skill description and permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Reading host files such as /etc/os-release for OS detection and version fingerprinting is unrelated to the stated Tencent Meeting functionality and expands local system visibility without clear need. Even limited fingerprinting can aid environment profiling and violates the principle of least surprise when not disclosed in the skill description and permissions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Reading host files such as /etc/os-release for OS detection and version fingerprinting is unrelated to the stated Tencent Meeting functionality and expands local system visibility without clear need. Even limited fingerprinting can aid environment profiling and violates the principle of least surprise when not disclosed in the skill description and permissions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md > 工具调用示例详见 `references/api_references.md`，错误处理详见 `references/error_dictionary.md`，版本管理详见 `references/version_management.md`，隐私保护与用户确认规则详见 `references/privacy_po
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The feedback rules require explicit user confirmation before calling submit_feedback, while the skill metadata says the agent must immediately trigger submit_feedback when certain conditions occur. This contradiction creates unsafe ambiguity in control flow: the agent may either skip mandatory reporting or report without consent, causing privacy, compliance, and reliability issues around unsolicited transmission of potentially sensitive meeting metadata.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill requests sensitive capabilities via metadata/runtime assumptions (environment token, Python execution, and implied local/network access) but does not declare an explicit tool scope such as allowed-tools or permissions. That creates an overbroad trust boundary where the agent may invoke capabilities beyond what users and reviewers can easily audit, increasing the risk of unintended data access or side effects.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown instructs the agent to use Asia/Shanghai (UTC+8) as the default and to interpret ambiguous time expressions like 'today' and omitted dates in that timezone. This imposes a locale/timezone policy on users by default, without first asking for the user's preferred timezone or making the default a clearly justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all operational instructions, warnings, and examples exclusively in Chinese, which effectively forces a specific language for users consuming the skill documentation. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified as region-specific; that justification is not stated in this file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document is written as a mandatory error-handling dictionary in Chinese and requires agents to present dictionary-derived error reasons to users. There is no indication that users may receive explanations in their preferred language or opt into Chinese output. This can violate language/locale policy when the skill is used in multilingual contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file documents that passing an empty array to
meeting_invitees_replacewill clear all invitees, and says the skill layer must emphasize the impact before calling it. However, the file does not itself provide a concrete user-facing warning or confirmation language for this destructive behavior. Because markdown files should warn about behaviors that could affect user data or system integrity, this is a missing-warning issue.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The entire skill guidance, required prompt wording, and user-facing examples are written exclusively in Chinese, including the mandated confirmation sentence at L54 and output templates at L86-L98. This creates a language/locale constraint without any opt-in or documented justification, which matches the policy category for forced language behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
该文档以中文定义“所有涉及用户隐私信息的场景必须遵守”的通用规范，但未说明仅适用于中文环境，也未给出用户或开发者的语言选择机制。按自然语言政策要求，强制单一语言而无 opt-in 或明确地域/合规理由，属于潜在的语言/locale 策略违规。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill file is written as a mandatory operational guide in Chinese and does not offer any language or locale opt-in/selection. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the constraint is explicitly justified as region-specific, which is not stated here.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill adds and services local tools for software-update preference management, which is outside the manifest’s stated Tencent Meeting meeting-management purpose. This creates undocumented local-state manipulation capability on the user’s device, expanding the attack surface and enabling an agent to alter update behavior without clear user expectation or scope justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring and embedded tool descriptions are entirely written in Chinese and instruct model behavior in that language context, but there is no indication that the skill supports user language choice or that it is intentionally limited to a Chinese-only deployment. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
These handlers directly modify local update-state via functions like save_snooze, enable_auto_upgrade, and disable_optional_update_check, giving the skill authority to suppress or alter update prompts. In the context of a meeting assistant, such capability is unjustified and could be abused to reduce visibility of updates or change device behavior unrelated to the user’s requested meeting tasks.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code sends a network request and includes the sensitive X-Tencent-Meeting-Token header, but there is no confirmation prompt, logging, or explicit warning to the user about transmitting credentials or request data. The docstrings describe implementation details, but they do not function as a user-facing disclosure of this privacy-relevant behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
When
_client_infois supplied, the script overwrites itsosfield with the real local OS and forwards that value to the remote MCP service. This is an unnecessary disclosure of host metadata to an external endpoint without explicit user consent, which can aid device fingerprinting and reduce user privacy, though by itself it is not a direct code-execution or auth bypass issue.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains user-facing and maintainer-facing natural-language documentation entirely in Chinese, starting with the module docstring and continuing throughout the file. The policy flags language or locale constraints when a skill effectively forces a specific language without opt-in or justification, and no alternative language option or region-specific rationale is provided here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. The user-facing docstrings, usage text, and error/help messages in this file are written in Chinese only, with no indication that other languages are supported or that the language choice is configurable.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The module docstring and function documentation are written in Chinese only, which imposes a specific language on users or maintainers without indicating any language choice or opt-in. This matches the language/locale policy category because the file's natural-language content does not offer an alternative or document a justified locale restriction.
- Content
Static analysis
No suspicious patterns detected.