ClawHub
Back to skill

Security audit

Meeting Notes → Tasks & Follow-up

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward meeting-notes helper with local file inputs and outputs, though its CSV export should be treated carefully when notes come from untrusted sources.

Install is reasonable for ordinary meeting-note cleanup. Avoid opening generated CSV files from untrusted transcripts directly in spreadsheet software unless formula-leading cells are sanitized first, and review extracted tasks because the heuristics are basic.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/task_extractor.py:21
Finding

CSV Formula Injection Through Attacker-Controlled Meeting Notes

Content
View full analysis
Remediation
View remediation
str: stripped = value.lstrip() if stripped.startswith(FORMULA_PREFIXES): return "'" + value return value tasks.append({ "task": sanitize_csv_cell(line), "owner": "unassigned", "status": "todo", "note": "extracted from meeting notes", }) ``` Representative regression tests should include: ```text =HYPERLINK("https://attacker.example","TODO") +SUM(1,1) action @SUM(1,1) follow up =1+1 next step ``` The generated CSV should contain inert text for each case and must not expose a formula-leading value after whitespace normalization. ]]>

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code generally aligns with the declared meeting-notes summarization purpose: it processes a local input text file and produces a recap-like JSON output with a summary and key points. However, the declared description specifically says it produces simple action lists, while the code does not extract tasks or action items at all. Instead, it collects open questions based on the presence of a question mark. This is a material behavior mismatch in output capability, even though there are no suspicious undeclared permissions or unrelated resource accesses.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code is narrowly focused on extracting task/action-item lines from an input text file and exporting them as structured CSV rows. The declared description promises a broader meeting-notes productivity workflow including clean summaries, extracted key points, and a clear recap in addition to action lists. Those summarization and recap capabilities are not present in the supplied code chunk. There is no evidence of undeclared sensitive behavior or inconsistent resource access, but the implemented functionality is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Tainted flow: 'summary' from pathlib.Path.read_text (line 20, file read) → pathlib.Path.write_text (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/meeting_summary.py (reported line 27)May include surrounding context.

python
}

    output_path.parent.mkdir(parents=True, exist_ok=True)
    output_path.write_text(json.dumps(summary, indent=2, ensure_ascii=False), encoding="utf-8")
    print(f"Wrote meeting summary to {output_path}")
    return 0

Static analysis

No suspicious patterns detected.