Security audit

JMin Meeting Notes

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward meeting-notes formatter with no code execution, persistence, external calls, or hidden authority.

Installers should treat this as a normal text-formatting skill. Before using it, redact client names, private employee details, credentials, financial figures, regulated data, or other sensitive material unless sharing that content with the agent is approved.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file presents the skill entirely in Chinese and instructs the user to invoke it with a Chinese phrase, without offering any language choice or documenting that the skill is intentionally Chinese-only. This creates a natural-language policy concern because it implicitly enforces a specific language/locale without user opt-in.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "整理会议纪要" is very broad and provides no clear activation constraints, so the skill could be invoked in contexts where the user did not intend to use this specific tool. In agent environments with multiple skills, overly generic triggers increase accidental routing and can expose private meeting content to the wrong workflow or cause unintended automated processing.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly encourages users to paste raw meeting notes and speech-to-text transcripts, which commonly contain confidential business information, personal data, client details, or internal decisions, but provides no privacy warning, minimization guidance, or sanitization instructions. In this context, the omission increases the likelihood that users will disclose sensitive data to the system unnecessarily, creating a real privacy and data-handling risk even though the skill's primary function is benign.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: This markdown file presents all templates and headings exclusively in Chinese, which can amount to a language policy issue when no user opt-in or alternative locale is provided. The content does not indicate that the skill is intended only for a Chinese-speaking or region-specific audience.

Static analysis

No suspicious patterns detected.