Meeting Agenda

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user expecting only agenda templates could also receive or run an unrelated local task-management tool.

Why it was flagged

This included script implements task-management commands, while the main SKILL.md documents meeting-agenda commands such as create, standup, retro, oneonone, decision, and minutes. The mismatch creates ambiguity about what code a user or agent would actually run.

Skill content

Productivity and task management tool

Commands:
  add
  list
  done
  priority
  today
  week
  remind
  stats
  clear
  export

Recommendation

Clarify the intended entrypoint, remove unused scripts, or document all included commands and why they are needed for meeting agendas.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Private meeting notes, action items, or task text entered into this script may remain on disk after the session.

Why it was flagged

The script stores user-supplied items and command history in persistent local files. This is not mentioned in the main skill instructions or registry requirements.

Skill content

DATA_DIR="${MEETING_AGENDA_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/meeting-agenda}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
...
cmd_add() {
    echo "$(date +%Y-%m-%d) $*" >> "$DB"

Recommendation

Make storage opt-in or clearly disclose it, document the storage location, provide a real cleanup/delete command, and ask before saving sensitive meeting content.