ClawHub

Meeting Notes Summarizer

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises, but users should know meeting transcripts are sent to Anthropic for summarization.

Install only if you are comfortable sending the meeting transcript to Anthropic using your API key. Avoid using it for confidential, regulated, legal, HR, customer, or personal data unless your organization permits that provider and data flow; also ensure bash, curl, python3, and ANTHROPIC_API_KEY are available.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly requires an API key and `curl`, which strongly implies transcript content is transmitted to an external service, but the description does not disclose that potentially sensitive meeting data leaves the local environment. This creates a real privacy and compliance risk because users may paste confidential business, HR, legal, or customer information without informed consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script sends the full meeting transcript to Anthropic's external API but does not provide any user-facing notice, consent prompt, or disclosure that potentially sensitive content will leave the local environment. In a summarization skill, transcripts commonly contain confidential business, HR, legal, or personal data, so silent exfiltration to a third party creates a real privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
print(json.dumps(prompt + transcript))
")

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
Confidence
95% confidence
Finding
curl -s https://api.anthropic.com/v1/messages \ -H "content-type: application/json" \ -H "x-api-key: $ANTHROPIC_API_KEY" \ -H "anthropic-version: 2023-06-01" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
print(json.dumps(prompt + transcript))
")

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
Confidence
95% confidence
Finding
https://api.anthropic.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal