tmeet-skill
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill functions by invoking the
tmeetCLI. It automatically configures environment variables such asTMEET_AGENTandTMEET_MODELto pass metadata to the tool during execution, which is standard for vendor-specific troubleshooting and telemetry. - [EXTERNAL_DOWNLOADS]: The skill provides automated installation instructions for the
@tencentcloud/tmeetpackage via the NPM registry. This resource is provided by the vendor and is used to establish the necessary environment for the skill's operations. - [DATA_EXFILTRATION]: The troubleshooting module (
tmeet tshoot log --upload) includes functionality to package local application logs and upload them to the vendor's servers. This is a documented feature intended for technical support and requires explicit user invocation of the--uploadflag. - [PROMPT_INJECTION]: The skill retrieves and processes meeting transcripts and AI-generated summaries, which are considered untrusted external data and could contain malicious instructions.
- Ingestion points: Meeting transcripts and smart minutes are accessed through commands in
references/tmeet-record.md. - Boundary markers: The instructions do not define specific delimiters or guardrails to prevent the agent from following instructions potentially embedded in the meeting text.
- Capability inventory: The skill has the ability to manage meetings, retrieve recordings, and upload diagnostic logs via the
tmeetCLI. - Sanitization: The skill does not specify any sanitization or validation steps for the content of the transcripts before processing.
Audit Metadata