Security audit

研究生组会录音智能总结助手。和老师讨论/组会汇报的录音,调用skill可以有针对性的识别出学生和老师的内容,同时以老师的内容为重点进行内容总结,根据用户指令,自定义选择以文本展示或者音频展示。

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles sensitive recordings with under-scoped network and runtime-install behavior that users should review carefully.

Install only if you are comfortable uploading recordings and generated summaries to SenseAudio and storing raw transcripts locally. Use it with non-confidential material or approved recordings, avoid setting SENSEAUDIO_API_BASE except to a trusted official endpoint, and prefer an environment where dependencies are preinstalled rather than allowing runtime pip installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.py:96
Finding: Arbitrary API endpoint can receive the bearer token and sensitive academic content
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/main.py:22
Finding: Unpinned dependency is installed automatically during program startup
Content: View full analysis
None: pip_name = pip_name or import_name try: importlib.import_module(import_name) return except ImportError: pass result = subprocess.run( [sys.executable, "-m", "pip", "install", pip_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, ) if result.returncode != 0: raise RuntimeError(result.stderr.strip()) importlib.import_module(import_name) ensure_python_package("requests") import requests ``` ### Technical Analysis When `requests` is unavailable, importing or starting the script automatically executes pip and installs the package without: - A pinned version. - A lockfile. - Package hash verification. - A trusted package-index restriction in the command. - An explicit setup phase or user confirmation. Python package installation can execute package build or installation logic with the privileges of the current process. The installed version and source also depend on the active pip configuration, environment variables, and configured package indexes. Although `requests` is a legitimate package, resolving an unconstrained dependency dynamically at runtime creates a supply-chain trust boundary that is unnecessary for the Skill's ASR/TTS operation. ### Attack Path 1. The runtime environment does not already contain an importable `requests` package. 2. An attacker controls or influences pip configuration, package-index settings, a package mirror, DNS/network resolution, or the environment used for installation. 3. The Skill starts and calls `ensure_python_package("requests")`. 4. The script invokes `python -m pip install requests` without a version or hash c ...[truncated 991 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
14. 不要绕到其他 TTS skill 或手工拼路径回复。会议摘要语音必须通过本 skill 的 `scripts/main.py tts` 或 `scripts/main.py run` 生成。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill invokes shell commands, reads/writes local files, uses environment variables, and makes network calls, but it does not declare any tool scope restrictions such as allowed-tools or permissions. That creates an overly broad execution surface where the agent may use more capabilities than users expect, increasing the chance of unintended command execution, file exposure, or external data transmission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This skill processes potentially sensitive academic discussion recordings and writes transcripts, diarized text, LLM input files, and audio summaries to local storage, but it does not prominently warn the user about that data handling. Users may unknowingly expose unpublished research, advisor feedback, personal data, or confidential institutional information through persistent local artifacts and external API submission.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to persist raw transcripts, diarized transcripts, verbose ASR JSON, and llm_meeting_input.txt, all of which may contain highly sensitive meeting content. Persisting these artifacts by default increases the risk of local disclosure, accidental reuse by other tools, and retention of more data than is necessary for the user’s immediate task.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The instructions prescribe --language zh in the standard execution flow and repeatedly describe the workflow as producing a final Chinese summary text, without offering a user choice of language or documenting a justified region-specific limitation. This is a natural-language locale policy issue because the skill effectively forces a specific language by default.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The default delivery instructions tell the agent to return paths to raw transcript files, encouraging disclosure and continued access to sensitive discussion content beyond the summarized result. Even if the path is only local, surfacing it normalizes retention and may expose confidential research discussions to anyone with filesystem access or later tool runs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The default prompt is written in English and directs a specific output behavior even though the skill metadata and intended users are Chinese-speaking. This mismatch can cause the skill to respond in the wrong language or apply role/summary assumptions without user opt-in, which may distort academic content and reduce user awareness of what processing is being performed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables implicit invocation without any trigger constraints, so the agent may auto-select it in contexts the user did not clearly intend. Because this skill processes recordings and produces summaries, unintended invocation could cause privacy-sensitive academic discussions to be transcribed or summarized without sufficiently explicit user consent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt explicitly requires the final spoken summary to be in Chinese and gives Chinese-only phrasing conventions. This is a natural-language locale constraint, and the file does not offer opt-in, fallback, or user choice for language.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Auto-installing Python packages at runtime is a real supply-chain risk and is unrelated to the stated purpose of meeting transcription and summary packaging. It allows the skill to modify the host environment and fetch executable code from external infrastructure without prior approval, which is especially risky in agent or shared execution contexts.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 93% confidence
Finding: The script automatically executes pip install at runtime when requests is missing. Although it does not invoke a shell, it still causes code from an external package index to be fetched and installed during execution, which expands the trust boundary and can lead to arbitrary code execution through dependency confusion, malicious mirrors, or compromised package distribution. In a skill that processes academic recordings, this behavior is not necessary for core functionality and makes the environment materially less safe.
Content: Scanner excerpt · scripts/main.py (reported line 37)May include surrounding context.
python
except ImportError: print(f"缺少 {pip_name}，正在自动安装...", file=sys.stderr) result = subprocess.run( [sys.executable, "-m", "pip", "install", pip_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE,

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/main.py (reported line 241)May include surrounding context.
python
}, } try: response = requests.post( f"{self.api_base}{TTS_API_PATH}", headers=self.headers_json, json=payload,

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The transcribe and run commands default --language to zh, and the file-level instructions and prompts are written to process content in Chinese-specific meeting contexts. This imposes a language/locale choice by default rather than offering a neutral default or explicit user opt-in, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The stated scope is converting small academic discussions into minutes and extracting role-specific discussion points. The implementation additionally requests enable_sentiment from the ASR service and injects sentiment labels into diarized output, which expands behavior beyond the manifest's described outputs.
Content: No source excerpt is available for this finding.