Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Meeting Summary Generator

v1.1.2

AI-powered meeting summary generator. Convert meeting notes into professional summaries and action items.

0· 439·2 current·2 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Functionality (generating meeting summaries via the 'sloan' agent) aligns with the name/description. Payment integration with skillpay is consistent with the declared pay-per-use model. However the package embeds a merchant key in code and lists an OPENCLAW_GATEWAY_TOKEN env var in SKILL.md that the code does not use—a minor incoherence.
Instruction Scope
SKILL.md and README describe CLI usage and optional env vars and match the code's CLI behavior. The runtime instructions do not request unrelated system files or extraneous environment variables. Note: the skill invokes a local 'openclaw' CLI (child process) with the user-supplied notes as the prompt — those notes may be sent to whatever backend the 'openclaw' agent uses.
Install Mechanism
No install spec (instruction-only) reduces install surface. The package includes code and a package-lock that resolves dependencies via a Tencent mirror (mirrors.tencentyun.com) rather than default npm registry; this is unusual and worth noting though not necessarily malicious.
!
Credentials
The only runtime secret referenced is SKILLPAY_MERCHANT_KEY, which is embedded as a default literal in index.js. Embedding a merchant key in source is poor practice and increases risk (exposed secret / possible misuse). SKILL.md also advertises OPENCLAW_GATEWAY_TOKEN but the code does not read or use it—an inconsistency.
Persistence & Privilege
Skill is not always-on and does not request elevated persistence. It runs as a CLI and spawns a local 'openclaw' agent; it does not modify other skills or system settings.
What to consider before installing
This skill appears to do what it says (generate meeting summaries using the local 'sloan' agent) but has a few red flags: 1) index.js contains a hard-coded SKILLPAY merchant key — this exposes a secret in the package and is poor practice; consider whether you trust the publisher or replace it with your own key. 2) SKILL.md lists OPENCLAW_GATEWAY_TOKEN even though code doesn't use it — minor inconsistency. 3) The CLI spawns the 'openclaw' agent and passes your meeting notes as the prompt; those notes may be sent to whatever backend the OpenClaw agent uses, so avoid including highly sensitive information. 4) package-lock uses third-party mirrors (mirrors.tencentyun.com); if you care about supply-chain provenance, audit dependencies or install from a vetted source. If you proceed: review the index.js yourself, set SKILLPAY_MERCHANT_KEY to your own merchant/key if required, test in offline/test mode (--test) before enabling payments, and ensure the 'openclaw' binary and remote endpoints are ones you trust.

Like a lobster shell, security has layers — review code before you run it.

latestvk97667c2h1d8va1k6hgggy3mfs82bc39
439downloads
0stars
11versions
Updated 7h ago
v1.1.2
MIT-0

Meeting Summary Generator

Convert meeting notes into professional summaries with action items and decisions.

Features

  • Professional Format - Clean, organized output
  • Action Items - Extract and prioritize tasks
  • Decision Log - Key decisions documented
  • Attendee Summary - Who said what

Usage

# Generate meeting summary
meeting-summary-generator "John: Let's launch next week. Sarah: I'll handle marketing."

# From file
meeting-summary-generator --file notes.txt

# With meeting details
meeting-summary-generator <notes> --title "Q1 Planning" --date 2026-03-05

Options

OptionDescriptionDefault
--titleMeeting title-
--dateMeeting date (YYYY-MM-DD)-
--fileRead notes from file-

Pricing

  • Pay per use: 0.003 USDT per generation

Environment Variables

VariableDescriptionRequired
SKILLPAY_MERCHANT_KEYPayment merchant key (optional, embedded key used by default)No
OPENCLAW_GATEWAY_TOKENGateway auth token for local API fallbackNo

Requirements

  • OpenClaw with Sloan agent (AI columnist)
  • OpenClaw Gateway running locally (for API fallback)

About Sloan

Sloan is your AI columnist - a professional meeting secretary specializing in structured summaries.

Support

License

MIT © Matt

Comments

Loading comments...