会议议程生成助手

• Outcome: Pass
• Latest audit: May 28, 2026 · 4:33 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate meeting agenda document generator, but it may install Python packages and use local Office/LibreOffice tools to create PDFs.

Install only if you are comfortable with a skill that runs a local Python script, writes agenda files, may install Python packages from a package index, and may invoke Word or LibreOffice for PDF conversion. Prefer preinstalling trusted dependencies, using a dedicated output folder, and reviewing generated filenames before running it on sensitive meeting information.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

missing.append(pkg)
    if missing:
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet"] + missing
        )

• Confidence: 97% confidence
• Finding: The script automatically installs Python packages at runtime via pip whenever dependencies are missing. In an agent skill context, this creates a supply-chain and arbitrary code execution risk because package installation executes untrusted code from package distributions without an explicit trust boundary or user approval.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation directs the agent to read local reference files and execute a shell command, but the skill manifest shown does not declare corresponding permissions. Undeclared file and shell capabilities weaken the trust boundary for the skill and can lead to surprising execution behavior that users and the platform did not explicitly authorize.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated purpose is simple agenda generation, but the documented behavior expands into runtime package installation and use of external applications/services for PDF conversion. That mismatch is dangerous because it obscures materially different capabilities—network/package management, subprocess execution, and dependence on host-installed software—that increase attack surface and can trigger unintended system changes.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Instructing the agent to auto-install Python packages at runtime gives the skill package-management capability beyond document generation. This can alter the local environment, pull code from package indexes, and introduce supply-chain risk if package sources, versions, or integrity are not tightly controlled.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The workflow requires launching a local Python script via shell, which introduces code-execution and subprocess behavior not reflected in the high-level manifest description. Even when intended for normal functionality, this expands the risk surface because untrusted input paths, environment variables, or modified local scripts could lead to unexpected execution outcomes.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Auto-installing packages at runtime is broader than necessary for a meeting agenda generator and introduces avoidable supply-chain exposure. In a skill execution environment, this lets the script fetch and run third-party code dynamically, which can be abused through dependency compromise, typosquatting, or unauthorized network egress.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The PDF conversion logic invokes external applications such as Microsoft Word, LibreOffice, and docx2pdf, expanding the trust boundary beyond simple document generation. In an agent skill, launching desktop apps and converters on attacker-influenced documents can expose the host to parser vulnerabilities, macro-related behaviors, or unsafe file handling in third-party software.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Installing packages automatically without explicit user warning or consent is unsafe in a security-sensitive agent environment. It can silently modify the runtime, introduce unreviewed code, and violate deployment expectations, making incident response and reproducibility harder.

Static analysis

No suspicious patterns detected.