Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward meeting-notes formatter with no code execution, persistence, external calls, or hidden authority.
Installers should treat this as a normal text-formatting skill. Before using it, redact client names, private employee details, credentials, financial figures, regulated data, or other sensitive material unless sharing that content with the agent is approved.
The file presents the skill entirely in Chinese and instructs the user to invoke it with a Chinese phrase, without offering any language choice or documenting that the skill is intentionally Chinese-only. This creates a natural-language policy concern because it implicitly enforces a specific language/locale without user opt-in.
The trigger phrase "整理会议纪要" is very broad and provides no clear activation constraints, so the skill could be invoked in contexts where the user did not intend to use this specific tool. In agent environments with multiple skills, overly generic triggers increase accidental routing and can expose private meeting content to the wrong workflow or cause unintended automated processing.
The skill explicitly encourages users to paste raw meeting notes and speech-to-text transcripts, which commonly contain confidential business information, personal data, client details, or internal decisions, but provides no privacy warning, minimization guidance, or sanitization instructions. In this context, the omission increases the likelihood that users will disclose sensitive data to the system unnecessarily, creating a real privacy and data-handling risk even though the skill's primary function is benign.
This markdown file presents all templates and headings exclusively in Chinese, which can amount to a language policy issue when no user opt-in or alternative locale is provided. The content does not indicate that the skill is intended only for a Chinese-speaking or region-specific audience.
