Meeting Notes Summarizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:27 PM UTC
• Version: 1.0.0

Overview

This meeting summarizer does what it claims, but it sends full meeting transcripts to Anthropic and handles the API key in a way users should review before installing.

Install only if you are comfortable sending meeting transcripts to Anthropic for processing. Avoid using it for confidential, regulated, customer, legal, HR, or security-sensitive meetings unless your organization permits that data flow, and use a dedicated Anthropic API key with spending limits and rotation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: summarize.sh:35

Finding

Anthropic API Key Exposed Through Process Arguments

Content

View full analysis

Vulnerability Details

File Location: summarize.sh, lines 35–47
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

Vulnerable Code

bash

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \
  -d "{
    \"model\": \"claude-sonnet-4-20250514\",
    \"max_tokens\": 1500,
    \"messages\": [{
      \"role\": \"user\",
      \"content\": $FULL_CONTENT
    }]
  }" 2>/dev/null)

Technical Analysis

The ANTHROPIC_API_KEY environment variable is expanded into curl's -H command-line argument. Consequently, the complete x-api-key header can appear in curl's process argument vector while the request is in progress.

On systems where process arguments are visible to other users or processes through tools such as ps or interfaces such as /proc/<pid>/cmdline, a local attacker may observe and recover the credential. Exploitation depends on the operating system's process-isolation configuration, the attacker's local access, and their ability to inspect the process during the relatively short request window.

This is an insecure secret-handling practice rather than evidence of intentional credential theft. The credential is sent only to the documented Anthropic API endpoint, which is necessary for the declared API-backed summarization functionality.

Attack Path

1. A victim configures ANTHROPIC_API_KEY and invokes summarize.sh.
2. The script expands the credential into the x-api-key curl header argument.
3. While curl is running, a local attacker repeatedly monitors process argument vectors.
4. If process arguments are visible under the host's access-control policy, the attacker extracts the API key from the header argument.
5. The attacker reuses the key to submit unauthorized requests to the Anthropic API unt ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

• Do not place authentication secrets directly in command-line arguments.
• Provide the sensitive header through a permission-restricted curl configuration supplied by a protected file descriptor or temporary file, where supported.
• If a temporary file is unavoidable, create it with permissions limited to the current user, install an EXIT trap before writing the secret, and remove the file on every exit path.
• Run the Skill under a dedicated, least-privileged account and configure the host to restrict cross-user process inspection.
• Use a dedicated API key with minimum required permissions, provider-side spending limits, monitoring, and regular rotation.
• Revoke and replace the key immediately if process monitoring or logs may have captured it.
• Explicitly document that meeting transcripts are transmitted to https://api.anthropic.com/v1/messages, because transcripts may contain confidential business or personal information.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

./summarize.sh < transcript.txt

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md

./summarize.sh < transcript.txt

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

./summarize.sh < transcript.txt

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · summarize.sh (reported line 34)May include surrounding context.

sh

print(json.dumps(prompt + transcript))
")

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly requires an external API key (ANTHROPIC_API_KEY), which strongly implies that meeting transcript contents are transmitted to a third-party service, yet the description does not disclose that sensitive meeting data leaves the local environment. This is dangerous because users may paste confidential business discussions, personal data, or regulated information into the tool without informed consent about external transmission and retention risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script reads a credential from ANTHROPIC_API_KEY and transmits the full stdin meeting transcript to a third-party API. For a summarization skill this behavior is functionally expected, but it still creates a real data-exfiltration/privacy risk because potentially sensitive meeting content leaves the local environment without any minimization, consent flow, or policy controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The hardcoded https://api.anthropic.com endpoint confirms the script is designed to send user-provided meeting content off-host to a third party. While not inherently malicious, this is still sensitive because the skill context involves transcripts, which commonly contain confidential business or personal data.

Content

Scanner excerpt · summarize.sh (reported line 34)May include surrounding context.

sh

print(json.dumps(prompt + transcript))
")

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The hardcoded https://api.anthropic.com endpoint confirms the script is designed to send user-provided meeting content off-host to a third party. While not inherently malicious, this is still sensitive because the skill context involves transcripts, which commonly contain confidential business or personal data.

Content

Scanner excerpt · summarize.sh (reported line 34)May include surrounding context.

sh

print(json.dumps(prompt + transcript))
")

RESPONSE=$(curl -s https://api.anthropic.com/v1/messages \
  -H "content-type: application/json" \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "anthropic-version: 2023-06-01" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends meeting transcripts to an external LLM service but provides no user-facing warning at runtime that transcript contents will leave the host. This is dangerous because users may pipe confidential notes, customer data, or internal discussions into the tool under the assumption processing is local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.