Morning Meeting Bwm

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:07 AM UTC
• Version: 1.0.0

Overview

This skill openly describes meeting automation, but it can turn Slack conversation into immediate actions across many business systems without clear approval or scoping.

Install only if the Slack channel is trusted and the hosting agent has strict permissions. Add human approval before any external, destructive, financial, infrastructure, publishing, customer, or credential-related action, and keep transcript-derived memory separate from approved task state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:7

Finding

Untrusted Slack Content Can Trigger Automated Agent Actions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-13
Vulnerability Type: Indirect instruction injection through untrusted meeting content
Risk Level: High

Vulnerable Code:

markdown

## Workflow

1. **10:00 AM Trigger** (1 hour after 9:00 AM meeting starts)
2. Read #morningmeeting Slack channel for human + AI conversation
3. Parse transcript for tasks and assignments
4. Delegate to appropriate AI agents
5. Execute any tasks agents can handle immediately
6. Send summary report back to #morningmeeting

Technical Analysis

The documented workflow treats Slack transcript content as a source of executable task instructions. It directs the hosting agent to parse assignments, delegate them to specialized agents, and immediately execute tasks those agents can handle.

The skill does not define an authorization boundary between ordinary conversation and approved commands. It also lacks trusted-sender verification, task allowlists, instruction-versus-data separation, confirmation requirements, and restrictions on side-effecting tools. Consequently, a malicious channel participant or compromised Slack account could place crafted instructions in the transcript and have them interpreted as legitimate assignments.

The supplied process-meeting.sh does not itself read Slack or execute delegated tasks. Exploitation therefore depends on the hosting agent implementing the workflow described in SKILL.md and possessing tools capable of taking actions.

Attack Path

1. An attacker gains permission to post in #morningmeeting, or compromises an account that already has access.
2. The attacker posts a message formatted as a meeting task or assignment, potentially including instructions to access files, invoke tools, modify services, send messages, or disclose information.
3. At the scheduled processing time, the hosting agent reads the channel transcript.
4. The malicious message is parsed as a ta ...[truncated 897 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all Slack transcript text as untrusted data rather than executable instructions.
2. Accept assignments only from an explicit allowlist of authenticated users and preserve sender identity during parsing.
3. Require a structured task format with validated fields such as requester, action, target, scope, and approval status.
4. Reject transcript content that attempts to redefine agent behavior, override policies, request secrets, or issue tool-level instructions.
5. Require human approval before any action that modifies data, contacts external systems, publishes content, accesses sensitive information, or invokes privileged tools.
6. Apply per-agent task and tool allowlists, least-privilege credentials, destination restrictions, and execution timeouts.
7. Generate a proposed execution plan for review instead of executing transcript-derived tasks immediately.
8. Record the source message, sender, approver, delegated agent, and resulting tool operations in an immutable audit log.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:36

Finding

Untrusted Meeting Content Can Poison Persistent Agent State

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-40
Vulnerability Type: Persistent storage of untrusted meeting-derived instructions
Risk Level: Medium

Vulnerable Code:

markdown

## Memory Storage

- Meeting summaries: `memory/meetings/YYYY-MM-DD-morning-meeting.md`
- Task assignments: `memory/tasks/active-tasks.md`
- Completed tasks: `memory/tasks/completed/`

Technical Analysis

The skill designates persistent files for meeting summaries and active task assignments. Because the source meeting transcript is untrusted and the workflow does not specify validation, sanitization, provenance tracking, or approval before storage, attacker-controlled Slack content may be incorporated into persistent agent state.

Free-form content placed in active-tasks.md or meeting summaries may later be interpreted as authoritative instructions by agents that consume these files. This creates a cross-session risk: a malicious message introduced during one meeting can continue influencing subsequent task processing after the original Slack interaction has ended.

The shell script creates the relevant meeting and task directories but does not write transcript content into these files. Exploitation requires the hosting agent to implement the documented storage workflow.

Attack Path

1. An attacker posts a crafted assignment or instruction in #morningmeeting.
2. The automation reads the transcript and generates a summary or active-task entry.
3. Because no validation or approval boundary is defined, attacker-controlled text is stored in a meeting file or memory/tasks/active-tasks.md.
4. A later agent session reads the persistent file as trusted task state.
5. The agent follows the poisoned entry or propagates it to other task and completion records.
6. The malicious instruction may continue to affect future sessions until it is detected and removed.

Impact Assessment

Exploitation could ...[truncated 554 chars]

Remediation

View remediation

Remediation Suggestions

1. Store meeting and task state as schema-validated structured data rather than free-form executable prose.
2. Preserve provenance fields, including the original Slack message identifier, authenticated sender, timestamp, parser version, and approval status.
3. Separate raw transcripts from approved task state and never treat raw or summarized conversation as agent instructions.
4. Require human review before promoting transcript-derived content into active-tasks.md or another trusted task store.
5. Sanitize or reject content containing policy overrides, tool instructions, secret requests, role changes, or attempts to influence future sessions.
6. Ensure agents read only approved task fields and cannot interpret comments, summaries, or quoted Slack text as commands.
7. Apply access controls and integrity protections to memory files, and maintain version history so poisoned entries can be identified and rolled back.
8. Expire stale tasks and periodically review persistent memory for unauthorized or anomalous instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly reads a Slack channel containing human and AI conversation, parses the transcript, and redistributes extracted tasks and summaries, but it provides no warning about accessing and sharing potentially sensitive internal communications. This creates a real privacy and data-governance risk because users may not realize their messages will be processed, stored in memory files, and relayed to other agents or channels.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The workflow states it will delegate tasks to other agents and execute tasks immediately when possible, yet the skill omits any warning that automated actions may affect user data, external services, or production systems. In this context, immediate execution after parsing a Slack conversation is especially risky because informal meeting text can be ambiguous, causing unintended or unauthorized actions across multiple operational domains.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.