Meeting Notes Summarizer

ReviewAudited by ClawScan on May 1, 2026.

Overview

The skill does what it says—summarizes meeting transcripts—but users should know it sends transcript text to Anthropic using their API key.

This appears safe for its stated purpose if you are comfortable sending the transcript to Anthropic. Check that your transcript is allowed to leave your environment, use a suitable Anthropic API key, and be aware that the registry metadata does not fully declare the script's dependencies.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Private meeting content may be transmitted to Anthropic for processing.

Why it was flagged

The script reads the full meeting transcript from stdin and sends it to Anthropic's messages API. This is expected for the skill's purpose, but meeting transcripts can contain sensitive information.

Skill content

TRANSCRIPT=$(cat) ... RESPONSE=$(curl -s https://api.anthropic.com/v1/messages ... \"content\": $FULL_CONTENT

Recommendation

Only use it with transcripts you are allowed to send to Anthropic, and review your organization's data-handling policy before use.

Low

#ASI03: Identity and Privilege Abuse

What this means

API calls may incur usage costs and operate under the user's Anthropic account.

Why it was flagged

The script requires and uses the user's Anthropic API key to call the provider. This is purpose-aligned and there is no evidence of hardcoding or leaking the key, but it is credential use.

Skill content

if [ -z "${ANTHROPIC_API_KEY:-}" ]; then ... -H "x-api-key: $ANTHROPIC_API_KEY"

Recommendation

Use an appropriate Anthropic API key, monitor usage, and avoid sharing the key in transcripts, logs, or shell history.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation or invocation may fail unless the user has the needed tools and environment variable configured.

Why it was flagged

The registry metadata under-declares runtime requirements: SKILL.md lists bash, curl, and ANTHROPIC_API_KEY, and summarize.sh also invokes python3. This is a packaging/metadata gap, not evidence of hidden behavior.

Skill content

Required binaries (all must exist): none ... Required env vars: none

Recommendation

Before installing, confirm bash, curl, python3, and ANTHROPIC_API_KEY are available, and consider updating metadata to declare them.