T01 · Skill Instruction Hijacking
Error
- Location
index.js:15- Finding
Untrusted Meeting Notes Are Embedded Directly into an Agent Prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
Meeting Summary Generator
Security checks for vulnerabilities and agentic risk
Overview
This meeting summarizer is mostly coherent, but it automatically performs paid billing with a hardcoded merchant key and has under-scoped external processing risks.
Review carefully before installing. The skill charges 0.003 USDT per run by default, includes a merchant key in the package, and sends meeting notes into an OpenClaw agent whose exact privileges are not defined here. Use only with non-sensitive notes unless you understand the Sloan agent configuration, and avoid installing until billing confirmation, credential handling, pinned installer versions, and dependency sources are tightened.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:9- Finding
Hardcoded Payment Merchant Credential Is Distributed with the Package
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:13- Finding
Mutable Installer Execution and Plaintext Dependency Sources Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documented purpose is meeting summarization, but the behavior includes payment processing, external billing/network access, and an embedded merchant credential fallback that is not clearly disclosed in the primary description. Hidden or under-declared monetization and network behavior is dangerous because it can trigger unauthorized charges, exfiltrate user content or metadata, and bypass informed consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill’s stated purpose is meeting-summary generation, but it performs a real external billing charge before producing output. This creates a hidden side effect not justified by the manifest and can lead to unauthorized or unexpected financial transactions whenever a user invokes the skill.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code includes a payment-processing capability unrelated to the core summarization function and triggers it automatically unless --test is supplied. In the context of a note summarizer, this is disproportionately dangerous because users would not reasonably expect the tool to initiate financial charges as part of basic text processing.
- Content
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The lockfile pins axios 1.13.6, which is flagged with multiple advisories including SSRF-related proxy bypass and prototype-pollution-based attack chains. For a meeting summary skill, network access is common, so dependency flaws in the HTTP client can directly affect requests involving user-supplied URLs, redirects, proxy handling, credentials, or untrusted response processing.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If the skill ever constructs multipart requests using user-influenced field metadata, an attacker may be able to manipulate request structure or smuggle unintended headers/content to downstream services.
- Content
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The package allows resolution to axios 1.13.6 under the declared semver range, and the finding indicates that version carries multiple known advisories, including SSRF-related and request-handling issues. In a skill context, HTTP client vulnerabilities are especially important because agent skills often fetch remote content or interact with external APIs, which can expose credentials, enable request manipulation, or bypass network restrictions.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The installation command uses
npx clawhub@latest, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users following the README could execute attacker-controlled code during installation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README advertises automatic payment handling and an embedded merchant key without a prominent warning or explicit user consent flow. In the context of a CLI skill, this is dangerous because users may trigger billable actions unexpectedly, and the presence of an embedded payment credential suggests hidden financial side effects and poor key-handling practices that could lead to unauthorized charges or abuse.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill advertises environment-variable-based capabilities but does not declare any explicit tool scope or permissions boundaries. In practice, this weakens transparency and reviewability, making it easier for a skill to access sensitive runtime secrets without clear user awareness or policy enforcement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This skill processes meeting notes, which often contain confidential business discussions, personal data, or strategic plans, yet the description provides no privacy warning about sending that content to AI services or a local gateway. Users may unknowingly transmit sensitive notes outside their expected trust boundary, creating confidentiality and compliance risks.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The code contains a hardcoded fallback merchant key for an external payment API, exposing a live-looking credential directly in the skill source. Hardcoded secrets can be extracted by anyone with code access and abused to impersonate the merchant, issue unauthorized charges, or disrupt billing operations.
- Content
js const { spawn } = require('child_process'); const CONFIG = { skillpay_api: 'https://api.skillpay.me/v1', merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea', price_per_use: 0.003, currency: 'USDT'
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Spawning an external CLI agent gives the skill a broader execution boundary than a simple local summarizer and sends user-controlled content into another executable. While this may be intended to access an AI model, it increases attack surface and trust assumptions because behavior depends on an external binary outside the file’s visible logic.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Meeting notes are passed to an external agent process without clear notice or consent, and those notes may contain sensitive internal business information, personal data, or confidential action items. In a meeting-summary skill, users are especially likely to provide sensitive content, making undisclosed external disclosure more risky.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The payment flow transmits billing-related data and a merchant credential to an external service with only a pricing message as user-facing context. Users are not clearly informed that invoking the skill triggers networked billing activity, which creates both privacy and financial transparency concerns.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This file is a manifest-type JSON file, so vague-trigger review applies. The package and bin name "meeting-summary-generator" describe a broad, common productivity task, but the manifest provides no activation constraints, explicit invocation phrases, or negative examples to clarify when the skill should or should not run.
- Content
Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
follow-redirects 1.15.11 is reported to leak custom authentication headers across cross-domain redirects. In a skill that may call external services to summarize or fetch content, this can expose API keys, bearer tokens, or internal credentials to attacker-controlled endpoints if redirects are followed automatically.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency is specified with a caret range (^1.6.0), which permits automatic installation of newer 1.x releases. This reduces build reproducibility and can unexpectedly pull in a later vulnerable version of axios, increasing supply-chain risk for a skill that may be installed and executed in different environments.
- Content
json "author": "Matt", "license": "MIT", "dependencies": { "axios": "^1.6.0" }, "openclaw": { "skill": true,