tmeet-skill
Pass
Audited by Gen Agent Trust Hub on Apr 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically installs the '@tencentcloud/tmeet' global npm package if not present. As the skill is authored by TencentCloud, this is a standard and safe installation of the official vendor-supplied CLI tool.
- [COMMAND_EXECUTION]: The skill executes shell commands to interact with the Tencent Meeting platform. It includes specific handling for OAuth login by running commands in the background to capture authentication URLs without blocking the session.
- [CREDENTIALS_UNSAFE]: While handling authentication, the skill explicitly prohibits the display of AccessTokens or RefreshTokens in terminal output. It uses environment variables like 'TMEET_AGENT' and 'TMEET_MODEL' to track the execution environment, which is a standard logging practice.
- [PROMPT_INJECTION]: The skill implements safety measures by requiring explicit user confirmation before executing destructive commands such as 'meeting cancel', 'meeting update', or 'auth logout'. It also mandates the use of meeting codes instead of IDs when presenting information to users to maintain internal data integrity.
- [DATA_EXFILTRATION]: No unauthorized data transmission patterns were identified. The skill's operations are confined to the intended functionality of managing conference data through the official Tencent Meeting CLI.
Audit Metadata