会议议程生成助手

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill appears to generate meeting agenda documents as described, but it can silently install packages and can write generated files outside the chosen output folder if given a crafted filename.

Install only if you are comfortable with a document-generation skill running a local Python script, installing Python packages if missing, and using local Office/LibreOffice tools for PDF conversion. Use a dedicated output folder, avoid accepting untrusted filename values, and prefer preinstalling reviewed dependencies instead of allowing runtime pip installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_agenda.py:22

Finding

Automatic Installation of Unpinned Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_agenda.py, lines 22–35
Vulnerability Type: Runtime supply-chain exposure through unpinned package installation
Risk Level: Medium

Vulnerable Code:

python

def ensure_deps():
    import importlib.util
    missing = []
    for pkg, import_name in [("python-docx", "docx"), ("docx2pdf", "docx2pdf")]:
        if importlib.util.find_spec(import_name) is None:
            missing.append(pkg)
    if missing:
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet"] + missing
        )


ensure_deps()

Technical Analysis

The script automatically invokes pip whenever either dependency is absent. Neither package version nor an artifact hash is pinned, so the code installed at runtime depends on the current state of the configured package index and the local pip configuration.

Python package installation can execute package build and installation logic. Consequently, compromise of a package release, package repository, dependency resolution path, or configured package index could result in arbitrary code execution during Skill invocation. Runtime installation also modifies the active Python environment without explicit user approval.

The use of an argument list prevents shell injection through these fixed package names, but it does not mitigate the package supply-chain risk.

Attack Path

1. The Skill invokes scripts/generate_agenda.py.
2. ensure_deps() discovers that python-docx or docx2pdf is unavailable.
3. The script executes python -m pip install --quiet using mutable, unpinned package names.
4. pip resolves packages from the environment's configured index and downloads the currently selected artifacts.
5. If the selected artifact or repository is compromised, malicious installation logic or package code executes with the privileges of the Ski ...[truncated 593 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic package installation from application execution.
2. Declare dependencies in a trusted dependency manifest and lockfile with exact versions.
3. Require artifact hashes, such as through pip install --require-hashes, to verify downloaded packages.
4. Install dependencies during a controlled setup or build phase rather than when processing user input.
5. Use a dedicated virtual environment or isolated container with only the required dependencies.
6. Restrict package resolution to an approved repository and review transitive dependencies.
7. If dependencies are missing at runtime, terminate with a clear error rather than modifying the environment automatically.
8. Reconcile the documentation with the implementation: SKILL.md refers to reportlab, while the script installs and uses docx2pdf.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_agenda.py:318

Finding

Output Path Traversal and Arbitrary Document Overwrite

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_agenda.py, lines 318–323
Vulnerability Type: Unsanitized user-controlled filename used in filesystem paths
Risk Level: High

Vulnerable Code:

python

safe_name = data.get("filename", "会议议程")
docx_path = str(out_dir / f"{safe_name}.docx")
pdf_path  = str(out_dir / f"{safe_name}.pdf")

build_docx(data, docx_path)
build_pdf_from_docx(docx_path, pdf_path)

The value originates from the user-controlled JSON document loaded earlier:

python

with open(args.data, "r", encoding="utf-8") as f:
    data = json.load(f)

Technical Analysis

The variable named safe_name is not sanitized or validated. An attacker can supply parent-directory components such as ../, platform-specific path separators, or an absolute path in the JSON filename field.

When combined with out_dir, parent-directory components can escape the intended output directory. With pathlib, an absolute right-hand operand can also replace the preceding base path. The resulting path is passed to Document.save() and the PDF conversion routines without a containment check or overwrite protection.

The script forcibly appends .docx and .pdf, which limits the file types that can be targeted, but it does not prevent modification of existing documents or placement of attacker-controlled documents in unintended writable directories.

Attack Path

1. An attacker supplies meeting data containing a crafted filename, for example:

   json

   {
     "title": "Attacker-controlled content",
     "filename": "../../shared/existing-report",
     "sections": []
   }
   

2. The script reads the untrusted filename value from the JSON file.

3. It constructs paths equivalent to:

   • output/../../shared/existing-report.docx
   • output/../../shared/existing-report.pdf

4. No normalization, basename validation, or output-directory containment c ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat filename strictly as a basename, not as a path.
2. Reject absolute paths, . and .. components, directory separators, drive prefixes, and platform-specific alternate separators.
3. Apply an explicit allowlist of acceptable filename characters and enforce a reasonable length limit.
4. Resolve both the output directory and final destination, then verify that each destination remains inside the output directory.
5. Refuse to overwrite existing files unless the caller explicitly authorizes replacement.
6. Generate a server-controlled filename or unique identifier when user-provided naming is unnecessary.
7. Apply the same validation independently to both Word and PDF destinations.

Example containment strategy:

python

raw_name = data.get("filename", "meeting-agenda")
if (
    not isinstance(raw_name, str)
    or not raw_name.strip()
    or Path(raw_name).name != raw_name
    or raw_name in {".", ".."}
):
    raise ValueError("filename must be a non-empty basename")

output_root = Path(args.output).resolve()
docx_path = (output_root / f"{raw_name}.docx").resolve()
pdf_path = (output_root / f"{raw_name}.pdf").resolve()

if output_root not in docx_path.parents or output_root not in pdf_path.parents:
    raise ValueError("output path escapes the selected directory")

if docx_path.exists() or pdf_path.exists():
    raise FileExistsError("refusing to overwrite an existing output file")

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The stated purpose is simple agenda generation, but the documented behavior includes runtime package installation and invocation of local/system resources for document conversion. Hidden side effects like pip installs and external application execution materially expand the attack surface and could modify the environment or run unreviewed code under the guise of formatting a document.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill directs the agent to read local reference files and execute a Python script via shell, but it declares no explicit tool scope or permissions. This creates an authorization gap where a document-formatting skill can access local files and run commands without clear user-visible restriction, increasing the chance of unintended command execution or file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description states that the skill produces documents following a standardized Chinese government/enterprise meeting agenda format with prescribed Chinese fonts and formatting. This imposes a specific language/locale convention without stating that the user can choose another locale or explicitly opt into the Chinese format.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger conditions say to use the skill whenever a user provides meeting information and asks to generate an agenda, and include a broad example phrase like '帮我做个会议议程'. The file does not provide exclusion conditions or negative examples, so it is unclear when this skill should activate versus more general document-formatting help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs saving files locally and may install packages, yet it does not require an explicit warning or opt-in for these side effects. Silent file creation and environment modification can surprise users, overwrite data, or violate least-astonishment expectations in ways that enable unsafe operation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly instructs executing a local Python script and auto-installing packages during normal use. Even if intended for convenience, this allows a content-generation workflow to trigger code execution and dependency retrieval, which can expose the system to malicious packages, compromised indexes, or unsafe script behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Automatic package installation is an out-of-scope capability for a document-formatting skill and can introduce unreviewed code into the runtime at execution time. If package sources are compromised or dependency resolution changes, the host may execute attacker-controlled install scripts or end up with a modified environment without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Silently installing packages without user confirmation removes an important trust boundary and can unexpectedly change the system state during a routine document-generation task. Even if no direct exploit occurs, this can violate least surprise, break environments, and expose the host to supply-chain compromise during installation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script automatically invokes pip to install packages at runtime, which causes arbitrary code from package installation hooks and transitive dependencies to execute in the host environment. For a meeting-agenda generator, silently modifying the Python environment and reaching out to package indexes is beyond expected behavior and increases supply-chain and environment-tampering risk.

Content

Scanner excerpt · scripts/generate_agenda.py (reported line 30)May include surrounding context.

python

missing.append(pkg)
    if missing:
        import subprocess
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet"] + missing
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a skill that generates Word and PDF agenda files in a standardized format, but this implementation goes further by automating Microsoft Word via COM and launching LibreOffice via command line. Spawning external applications is a broader host-level capability that is not explicitly justified or declared by the skill description.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_agenda.py (reported line 272)May include surrounding context.

python

break
    if soffice:
        try:
            result = subprocess.run(
                [soffice, "--headless", "--convert-to", "pdf",
                 "--outdir", pdf_dir, docx_abs],
                capture_output=True, timeout=60

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire template, field labels, date examples, and formatting guidance are written exclusively in Chinese and prescribe Chinese-specific conventions such as Chinese weekday/date formatting and GB2312 fonts. There is no indication that this skill is region-specific or that users may opt into another language or locale, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The script saves generated documents to user-specified output paths and may overwrite existing files with the same derived name. While file generation is part of the skill's purpose, there is no visible disclosure about this write behavior or potential replacement of existing files at the save points.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.