Security audit
Security checks for vulnerabilities and agentic risk
This is a simple meeting-summary skill with some privacy and trigger-scope caveats, but no hidden code execution, exfiltration, or privileged behavior was found.
Before installing, treat meeting transcripts as potentially sensitive. Redact secrets, credentials, HR details, legal discussions, and regulated customer data unless your organization allows sharing that content with the agent. Use the skill for meeting-derived notes and follow-ups, and be cautious about sharing prior meeting history across sessions.
The manifest trigger list includes generic phrases such as "meeting notes," "action items," and "follow-up email," which overlap with common everyday requests and could invoke the skill outside a clear meeting-analysis context. The file also does not provide exclusion conditions or negative examples to clarify when these triggers should not activate the skill.
The activation section describes broad intents like "Meeting summarization" and "Follow-up email drafting" without defining boundaries for meeting-related context versus general summarization or email-writing requests. Because no negative examples or limiting conditions are provided, the activation criteria may cause unintended invocation for ordinary productivity requests.
This skill is designed to process meeting transcripts, which commonly contain sensitive business, HR, legal, or personal information, yet it provides no warning or handling guidance for confidential content. That omission increases the risk that users will paste regulated or proprietary data into the skill without understanding retention, sharing, or minimization expectations.
The statement that the skill 'can maintain context across sessions if history is shared' implies retention or reuse of prior meeting content, which can expose sensitive discussions beyond the original interaction boundary. In the context of meeting intelligence, this is especially risky because cross-session memory may inadvertently leak confidential decisions, attendee details, or action items into later summaries for other users or contexts.
- Works with any transcript format (Zoom, Google Meet, Teams, or raw text)
- Can accept timestamps — will annotate key moments
- Best results with clear speaker labels, but handles raw text too
- For recurring meetings: can maintain context across sessions if history is shared
---
No suspicious patterns detected.