ClawHub
Back to skill

Security audit

会议健康度分析仪

Security checks for vulnerabilities and agentic risk

Overview

This skill analyzes meeting participation and minutes as advertised, with sensitive meeting-data use disclosed and no hidden persistence or exfiltration found.

Install only where tmeet access is authorized for the meetings being analyzed. Treat generated reports as confidential because they may include participant names, speaking patterns, and meeting decisions; store or share them according to your organization's meeting-data policy.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README instructs users to pull meeting reports and intelligent minutes, which commonly contain sensitive business discussions, participant identities, and attendance details, but it provides no privacy, retention, or access-control guidance. In a meeting-analysis skill, this omission increases the likelihood that users will ingest, store, or share confidential data insecurely, creating a realistic data exposure risk even though the README itself does not directly exfiltrate data.

Static analysis

No suspicious patterns detected.