Ai Meeting Notes

• Outcome: Review
• Latest audit: May 29, 2026 at 9:34 PM UTC
• Version:
  1.0.0

Overview

This meeting-notes skill is not clearly harmful, but it asks users to connect a broad external API platform that goes well beyond meeting transcription and summarization.

Review the remote SkillBoss setup before installing. Use a scoped or spend-limited key if available, require confirmation before uploading meeting recordings or transcripts, avoid confidential or regulated meetings unless external AI processing is approved, and monitor model costs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is marketed as a narrowly scoped meeting-notes tool, but the setup text grants access to hundreds of unrelated APIs including scraping, social, email, image, and video services. This creates a scope mismatch that can mislead users and agents into authorizing a far broader integration than necessary for transcription and summarization.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Advertising unjustified capabilities such as scraping, social data, email, image, and video APIs in a meeting-notes skill violates least-privilege expectations. If an agent or user relies on this skill, sensitive meeting content could be exposed within an unnecessarily broad third-party platform footprint.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The activation guidance is broad enough that an agent may invoke the skill for generic meeting-related requests rather than only explicit external-transcription tasks. That increases the chance of unnecessary third-party routing of user content, including potentially sensitive meeting data.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The skill encourages use for meeting notes without warning that meeting transcripts or recordings will be sent to an external API. Because meeting content often contains confidential business, personal, or regulated information, omission of this disclosure meaningfully increases privacy and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.