Ghostmeet

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:53 AM UTC
• Version: 1.0.4

Overview

This meeting assistant is coherent, but installation asks users to run unpinned external Docker and browser-extension code that would handle meeting transcripts and an API key.

Review this before installing. The chat skill itself is narrow, but following the setup runs external Docker and Chrome extension code that can process meeting audio/transcripts and use your Anthropic key. Only install from a repository revision you trust, inspect the Docker Compose and extension permissions first, restrict network exposure, and avoid using summaries for meetings whose transcript should not be sent to Anthropic.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:22

Finding

Mutable Remote Repository Is Retrieved and Executed Without Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–27
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash

# Quick start
git clone https://github.com/Higangssh/ghostmeet.git
cd ghostmeet
cp .env.example .env
# Edit .env: set GHOSTMEET_ANTHROPIC_KEY for AI summaries
docker compose up -d

Technical Analysis

The installation procedure clones the mutable default branch of an external GitHub repository and immediately launches the retrieved Docker Compose project. It does not pin a reviewed commit or signed release, verify a checksum or signature, pin container images by digest, or require inspection of the downloaded Compose and Docker configuration.

Consequently, the payload that executes can change after this Skill has been reviewed. An attacker who compromises the upstream repository, its maintainer account, the default branch, or a referenced container image could alter the Compose configuration, Dockerfiles, images, entry points, mounts, environment handling, or startup commands. A user following the documented procedure would then execute that changed content.

The external backend is not included in the audited artifact. Therefore, its exact container privileges, host mounts, network access, secret handling, authentication, and runtime behavior could not be verified.

Attack Path

1. An attacker compromises the upstream GitHub repository, a maintainer account, the mutable default branch, or a container image referenced by the repository.
2. The attacker modifies the repository or image to include malicious startup commands or container configuration.
3. A user follows the Skill's quick-start instructions and runs git clone without selecting a known-good revision.
4. The user places GHOSTMEET_ANTHROPIC_KEY in the downloaded project's .env file as instructed.
5. The user runs docker compose up -d, causing the unverified r ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installation to a reviewed commit hash or cryptographically signed release rather than cloning the mutable default branch.
2. Pin every container image by immutable digest and avoid mutable tags such as latest.
3. Publish and verify checksums or signatures for release artifacts before execution.
4. Require users to inspect the Compose file, Dockerfiles, entry points, host mounts, exposed ports, Linux capabilities, restart policies, and Docker socket access before startup.
5. Run containers as non-root users with read-only filesystems where practical, drop unnecessary Linux capabilities, enable no-new-privileges, and avoid privileged mode and sensitive host mounts.
6. Provide secrets through a restricted secret-management mechanism rather than placing API keys in a broadly accessible project environment file. Ensure secret files have restrictive permissions and are not mounted into components that do not require them.
7. Restrict outbound network access to destinations required for the declared functionality and keep transcript submission explicitly user-triggered.
8. Document the exact audited repository revision and image digests in SKILL.md, together with a safe upgrade and re-verification process.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Quick start

git clone https://github.com/Higangssh/ghostmeet.git cd ghostmeet cp .env.example .env

Edit .env: set GHOSTMEET_ANTHROPIC_KEY for AI summaries

docker compose up -d

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest description says the skill can 'Start sessions,' implying it can initiate meeting capture. However, the body of the skill documentation explicitly states 'Start/stop recording' must be done manually via the Chrome Extension and that the skill only reads API results, which is a narrower capability than the manifest claims.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description functions as developer-facing intent documentation and states the skill can 'Start sessions.' Later documentation explicitly says 'Start/stop recording' must be done manually via the Chrome Extension. These statements actively conflict about whether session initiation is part of the skill's behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.