Security audit

Meeting Assistant

Security checks for vulnerabilities and agentic risk

Overview

This meeting-assistant skill is coherent and purpose-aligned, but users should understand that meeting records are saved locally in plain JSON.

Install only if local plain-text storage of meeting details is acceptable for your environment. Avoid using it for confidential meetings on shared or backed-up machines unless you add deletion, access-control, or encryption practices yourself.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The invocation examples "整理会议纪要", "提取待办事项", and especially "安排下周会议" are generic natural-language requests without any explicit trigger scope, constraints, or exclusion conditions. In a manifest-like skill description, this makes it unclear when the skill should activate versus when a user is simply discussing routine work tasks, increasing the risk of unintended invocation.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly stores meeting records in a local JSON file under a user workspace, and meeting notes commonly contain sensitive business information, attendee identities, action items, and timelines. The documentation does not warn about local persistence, retention, access control, or handling of confidential content, which can lead to unintentional exposure on shared machines or insecure environments.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: The skill's docstring, command examples, output text, and trigger matching are all written for Chinese-language use, with no indication that users may choose another language or that the restriction is intentional. This can constitute a language/locale policy issue because the skill effectively forces one language without opt-in.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Meeting notes and minutes can contain sensitive business data, attendee names, action items, and internal decisions. This function persists that content to local JSON storage automatically without consent, disclosure, retention controls, or access protections, creating privacy and confidentiality risk if the host environment is shared, backed up, or otherwise accessible.

Natural-Language Policy Violations

Low

Confidence: 79% confidence
Finding: The natural-language instructions and usage examples are presented only in Chinese, with no indication that users may choose another language or locale. This can be a language/locale policy concern when a skill implicitly requires a specific language without opt-in or justification.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The skill title, trigger rules, feature descriptions, and example dialogue are all presented in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill implicitly constrains interaction language without opt-in or justification.

Intent-Code Divergence

Low

Confidence: 98% confidence
Finding: The module docstring states that the assistant supports speech-to-text, alongside meeting notes, action items, scheduling, and templates. However, the code only processes text inputs, JSON persistence, parsing, formatting, and statistics; there is no audio input, transcription library, or related logic anywhere in the file.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: Persisting created meetings to disk without user awareness can expose schedules, participant lists, and locations. In this skill's context, that metadata may reveal internal operations or personal information, though it is typically less sensitive than full meeting notes.

Static analysis

No suspicious patterns detected.