Security audit

Meeting Assistant

Security checks for vulnerabilities and agentic risk

Overview

This meeting assistant stores and organizes meeting notes locally, with some privacy-sensitive workflows that users should keep scoped and review before sharing externally.

Install only if you are comfortable with your agent creating and updating local meeting records and action lists. Use explicit meeting-assistant phrasing if your environment auto-routes skills, treat the meetings folder as sensitive, and manually review any follow-up drafts or newsletter ideas before sharing them outside your workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The phrase "meeting notes" is extremely broad and naturally occurs in routine user speech. If the platform uses pattern-based dispatch, the skill may activate when the user is merely discussing notes rather than intending to run the workflow, causing unintended note capture, formatting, or persistence of sensitive content.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger phrase "action items" is generic and likely to appear in ordinary conversation about meetings, tasks, or documents. In an always-on or loosely routed agent environment, this can cause unintended invocation of the skill, leading to accidental file creation/modification or extraction of commitments from unrelated text.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: All meeting notes and action items are stored **locally in your workspace**. Nothing is shared or transmitted externally. Meeting records may contain sensitive business information — treat the `meetings/` folder accordingly. The agent will **never** automatically send meeting notes or action items to anyone. All outbound communication (follow-up emails, Slack messages) requires your explicit instruction. ---
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The newsletter-mining workflow encourages scanning recent meeting files and extracting ideas for external content without any warning to exclude confidential, personal, client, or privileged information. In a meeting-assistant skill that aggregates business conversations, this creates a real risk of repurposing sensitive meeting content into publishable material, causing privacy, confidentiality, or contractual breaches.

Vague Triggers

Low

Confidence: 84% confidence
Finding: The trigger "open actions" is ambiguous and could match many normal productivity conversations unrelated to this skill. While lower risk than broader capture phrases, it can still invoke review behavior unexpectedly and surface or manipulate task data the user did not intend to access in that moment.

Static analysis

No suspicious patterns detected.