ClawHub
Back to skill

Security audit

会议记录整理与行动项提取

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent meeting-notes helper, but its optional integration guide includes third-party AI processing and bulk Jira issue creation without clear consent or confirmation safeguards.

Install only if you are comfortable using it as a meeting-summary template and review any generated action items before sharing. Do not let an agent sync notes, send bot messages, upload transcripts, or create Jira/Linear issues unless you have participant consent, approved vendors, scoped tokens, and explicit confirmation for each external write.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The meeting summary template, extraction rules, priority labels, checklist, output format, and tips are primarily written in Chinese or bilingual Chinese-first form. This effectively steers the skill toward Chinese output and workflow conventions without explicit user opt-in or a stated language-selection mechanism.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The listed Chinese weak triggers include broad phrases like "我们应该...", "可以考虑...", and "最好能...", which commonly appear in ordinary discussion and do not clearly distinguish actionable commitments from general brainstorming. The guide labels them as triggers without giving exclusion criteria or negative examples, making activation scope ambiguous.

Vague Triggers

Medium
Confidence
95% confidence
Finding
Phrases such as "We should probably...", "It would be good if...", and "Someone needs to..." are broad conversational forms that often express ideas rather than agreed tasks. Because the document provides no explicit boundaries or non-trigger examples, the extraction criteria are likely to fire on ambiguous discussion.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest describes a skill for organizing meeting notes, extracting action items, and generating structured summaries from transcripts or notes. This file documents behavior that pushes outputs into external collaboration and project-management systems, including bot-delivered summaries and automatic Jira issue creation, which is broader than pure note processing.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The Python example uses a bearer token and sends POST requests to create Jira issues. For a skill presented as transforming meeting notes into structured summaries and action items, authenticated issue creation in an external system is an additional capability that is not explicitly justified by the manifest description.

External Transmission

Medium
Category
Data Exfiltration
Content
}
        }
        
        response = requests.post(
            f"{jira_config['base_url']}/rest/api/3/issue",
            json=payload,
            headers=headers
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The workflow recommends sending recordings or transcripts to third-party AI services without mentioning consent, data classification, retention, or confidentiality controls. Meeting notes often contain personal data, internal strategy, and customer information, so omission of privacy safeguards can lead to unauthorized disclosure or policy violations.

Natural-Language Policy Violations

Low
Confidence
72% confidence
Finding
The document specifies trigger recognition only for Chinese and English and does not state whether other languages are unsupported by design or whether the user can choose locale behavior. This can create a language-policy concern if the skill is applied in multilingual contexts without explicit opt-in or limitation.

Natural-Language Policy Violations

Low
Confidence
97% confidence
Finding
The embedded prompt explicitly specifies "语言：中文", which forces a specific language choice in natural-language instructions. The file does not state that this guide is intentionally China/Chinese-only or offer an option to choose another language.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The title explicitly labels the file as a Chinese meeting-template collection, and the entire template content is written only in Chinese. Because this is natural-language guidance rather than a clearly documented region-specific compliance artifact, it imposes a locale/language constraint without user opt-in.

Static analysis

No suspicious patterns detected.