Tmeet Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.6

Overview

This appears to be a legitimate Tencent Meeting CLI helper, but it needs review because it can automatically install a global executable and handle sensitive meeting, credential, contact, recording, and log data.

Review this before installing in a sensitive workspace. Prefer installing a pinned, reviewed tmeet CLI yourself instead of allowing automatic global @latest installation, confirm all meeting-changing actions, avoid sharing auth status output, and do not upload logs or feedback unless you have checked that they do not contain private meeting, account, or business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Automatic Global Installation of an Unpinned npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-26
Vulnerability Type: Supply-chain exposure through a mutable, globally installed dependency
Risk Level: Medium

Vulnerable command:

bash

npm install -g @tencentcloud/tmeet@latest

The surrounding instructions state that this command is automatically executed when the tmeet executable is not detected.

Technical Analysis

The Skill installs the mutable latest release of @tencentcloud/tmeet globally. The project provides no exact version constraint, lockfile, package integrity hash, vendored source, or other mechanism that would allow the installed artifact to be verified against the version reviewed during this audit.

npm packages can define lifecycle scripts that run during installation. Consequently, a compromised package release, registry account, dependency, or package distribution channel could execute code during installation. Use of the global installation flag also increases the affected scope compared with a project-local, isolated dependency.

The vendor-scoped package name reduces the likelihood of ordinary dependency confusion, but it does not eliminate package-account compromise, malicious dependency updates, registry compromise, or unintended behavior changes in a future latest release.

Attack Path

1. An attacker compromises the package publisher, registry distribution path, or a transitive dependency used by a future release.
2. A malicious or compromised release becomes the version selected by the latest tag.
3. The Skill runs on a system where the tmeet executable is absent.
4. The documented automatic installation invokes npm install -g @tencentcloud/tmeet@latest.
5. npm downloads the mutable release and may execute its installation lifecycle scripts.
6. Malicious code runs with the privileges of the user or service account operating the Agent.
7. The installed executable can subsequently process ...[truncated 857 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than using @latest.
2. Commit and enforce an integrity record or lockfile where the installation model permits it.
3. Verify the expected npm registry and package integrity before installation.
4. Avoid automatic global installation. Prefer a project-local or otherwise isolated installation with minimal filesystem permissions.
5. Require explicit user approval before downloading or installing executable third-party components.
6. Review the package and its dependency tree, including lifecycle scripts, before approving a release.
7. Disable npm lifecycle scripts with --ignore-scripts if the package can function without them.
8. Run the CLI under a dedicated, least-privileged account or sandbox and limit its access to unrelated files and environment variables.
9. Establish a controlled upgrade process so that dependency updates are reviewed and tested before deployment.

other

Note

• Location: SKILL.md:58

Finding

Undisclosed Collection of Agent and Model Identity Metadata

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 58
Vulnerability Type: Undisclosed Agent metadata collection and process-environment exposure
Risk Level: Low

Instruction at the affected location, rendered in English:

text

On the first auth login invocation or after switching models, write the
current Agent type to TMEET_AGENT and the model name to TMEET_MODEL
without asking the user.

Technical Analysis

The Skill explicitly requires the Agent implementation and model identity to be placed in environment variables without asking the user. These values are not shown to be necessary for OAuth authentication or meeting management in the audited documentation.

Environment variables supplied to the tmeet process are readable by that process. They may also be inherited by child processes that it starts. This creates an undisclosed metadata channel through which the externally installed CLI can identify the Agent platform and model in use.

The audited files do not prove that tmeet transmits these values to a remote service. Therefore, this finding is limited to collection and local disclosure to the invoked process; it does not assert confirmed network exfiltration.

Attack Path

1. A user initiates the first OAuth login or changes the model used by the Agent.
2. The Skill derives the current Agent type and model name without requesting user input or consent.
3. The values are assigned to TMEET_AGENT and TMEET_MODEL.
4. The tmeet process reads these variables during login or subsequent execution.
5. Any child process inheriting the environment may also receive the values.
6. If the external CLI implements telemetry using these variables, the metadata could be associated with authentication or operational activity; however, such transmission is not established by the reviewed project.

Impact Assessment

The exposed information is limited to Agent and model identity rath ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the metadata assignment unless it is essential to a documented function.
2. Clearly document why the Agent and model identities are collected, how they are used, whether they are transmitted, and how long they are retained.
3. Obtain explicit user consent before exposing these values to the CLI.
4. Use coarse, non-identifying capability information instead of exact product and model names where possible.
5. Scope the variables to a single subprocess rather than exporting them into the broader Agent environment.
6. Ensure child processes do not inherit the values unless inheritance is necessary.
7. Provide a supported opt-out mechanism that does not prevent authentication or core meeting operations.
8. Audit the external CLI implementation and network behavior to determine whether the variables are transmitted or retained remotely.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction says the agent/model variables must be written on first login or after model switches and explicitly says not to ask the user. That is a stronger policy violation because it forces disclosure of execution-environment metadata to the tool or downstream services, potentially enabling fingerprinting, policy bypass tailoring, or silent telemetry collection unrelated to the user's requested meeting task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The status documentation shows credential-related fields such as OpenId and token validity information without warning users that this output is sensitive and should not be copied into chats, logs, screenshots, or bug reports. Even if full token values are not displayed in the example, the command is described as showing credential information, which can lead agents or users to expose authentication state and potentially secrets in shared contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document describes write-capable meeting creation and update commands that can change access restrictions, waiting-room behavior, invitations, and recording/transcription settings, but it does not consistently require explicit user confirmation for these operations. In an agent setting, this increases the risk of unintended privacy-impacting changes, accidental attendee notifications, or enabling/disabling recording-related features without sufficiently clear consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents commands that access attendance-related data about meeting participants and waiting-room members, which can contain personal or sensitive information. The instructions provide usage examples and parameters but do not warn users about privacy implications, authorization expectations, or careful handling of exported/listed attendee data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly advertises a --upload option for packaging and sending local logs from ~/.tmeet/logs/ to a server, but it does not warn that logs may contain sensitive data such as account identifiers, meeting metadata, device details, or tokens. In an agent-operated CLI context, this omission is more dangerous because an agent may invoke troubleshooting commands automatically, causing users to transmit sensitive diagnostics without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The feedback command sends free-form incident details (--intent, --actions-tried, --result, and optional error metadata) to a platform, yet the documentation does not clearly disclose that these fields may contain sensitive user, meeting, or operational information that will be transmitted off-host. In this skill's context, the risk is heightened because agents may populate these fields from prior command outputs or user requests, potentially exfiltrating internal data to the platform unintentionally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill explicitly instructs the agent to write its runtime agent type and model name into TMEET_AGENT and TMEET_MODEL without user opt-in or a clear functional need for Tencent Meeting operations. This creates unnecessary environment-based telemetry disclosure and expands data collection beyond what is required to authenticate or manage meetings.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The file presents operational instructions entirely in Chinese, including headings, warnings, and workflow guidance, without indicating that language is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file's headings, instructions, warnings, and parameter descriptions are presented in Chinese throughout, which effectively forces a specific language for using the skill documentation. There is no indication that users may opt into another language, nor any documented justification that this skill is intentionally limited to a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.