Security audit
Security checks for vulnerabilities and agentic risk
This meeting-notes skill is a simple, coherent Markdown-only skill, but users should understand that it stores meeting notes and action items persistently.
Install only if you are comfortable with meeting notes and action items being written to local JSON files. Avoid using it for highly confidential meetings unless you have confirmed where those files are stored, who can access them, and how to delete or redact records.
The file presents the skill name, description, tags, headings, and examples entirely in Chinese, with no indication that users can select another language or that the skill is intended only for a Chinese-speaking or region-specific environment. This creates a language/locale constraint in natural-language content without user opt-in.
The trigger section lists generic phrases such as “记录会议”, “会议记录”, “查看会议”, and “搜索会议” without clarifying boundaries, exclusions, or the context in which the skill should activate. Because these are common phrases in ordinary conversation and no negative examples or scope constraints are provided, the skill could be invoked unintentionally.
The skill explicitly stores meeting records and action items persistently, but gives no notice about retention, sensitivity, access controls, or privacy implications. Because meeting notes often contain confidential business discussions, participant identities, and task ownership, silent persistence can expose sensitive data to unintended retention or later access.
No suspicious patterns detected.
