tmeet-skill

Pass

Audited by Gen Agent Trust Hub on May 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill functions by invoking the tmeet CLI. It automatically configures environment variables such as TMEET_AGENT and TMEET_MODEL to pass metadata to the tool during execution, which is standard for vendor-specific troubleshooting and telemetry.
  • [EXTERNAL_DOWNLOADS]: The skill provides automated installation instructions for the @tencentcloud/tmeet package via the NPM registry. This resource is provided by the vendor and is used to establish the necessary environment for the skill's operations.
  • [DATA_EXFILTRATION]: The troubleshooting module (tmeet tshoot log --upload) includes functionality to package local application logs and upload them to the vendor's servers. This is a documented feature intended for technical support and requires explicit user invocation of the --upload flag.
  • [PROMPT_INJECTION]: The skill retrieves and processes meeting transcripts and AI-generated summaries, which are considered untrusted external data and could contain malicious instructions.
  • Ingestion points: Meeting transcripts and smart minutes are accessed through commands in references/tmeet-record.md.
  • Boundary markers: The instructions do not define specific delimiters or guardrails to prevent the agent from following instructions potentially embedded in the meeting text.
  • Capability inventory: The skill has the ability to manage meetings, retrieve recordings, and upload diagnostic logs via the tmeet CLI.
  • Sanitization: The skill does not specify any sanitization or validation steps for the content of the transcripts before processing.
Audit Metadata
Risk Level
SAFE
Analyzed
May 16, 2026, 02:13 AM
Security Audit — agent-trust-hub — tmeet-skill