Security checks across malware telemetry and agentic risk
This meeting automation skill is not clearly malicious, but it needs review because it can send meeting content to external workplace tools under broad triggers and has inconsistent packaging and disclosure.
Install only if you are comfortable with meeting transcripts, summaries, action items, and user identifiers being sent to configured services such as Feishu, WeCom, Notion, OpenAI, or SkillPay. Review and narrow the trigger wording, add confirmation before posting or creating tasks, validate webhook hosts, fix the missing requirements file and broken main_processor.py, and avoid running cleanup on original local recordings.
# 写入文件
downloaded_bytes = 0
with open(save_path, "wb") as f:
for chunk in response.iter_content(chunk_size=8192):
if chunk:
f.write(chunk)},
}
response = requests.post(WECOM_WEBHOOK_URL, json=payload, timeout=10)
response.raise_for_status()
result = response.json()payload = {"msgtype": "markdown", "markdown": {"content": content}}
response = requests.post(WECOM_WEBHOOK_URL, json=payload, timeout=10)
response.raise_for_status()
result = response.json()64/64 vendors flagged this skill as clean.