ClawHub
Back to skill

Security audit

Meeting Notes Assistant

Security checks for vulnerabilities and agentic risk

Overview

This meeting-notes skill should be reviewed because it advertises local/private handling while its notes-generation flow can send sensitive transcripts to external LLM APIs.

Install only after deciding whether external LLM/cloud processing is acceptable for your meeting content. For confidential meetings, use local transcription and `--no-llm`, avoid setting OPENAI_API_KEY or llm_api_key, and be cautious with PDF export from untrusted notes until HTML escaping/resource blocking is fixed. Use a virtual environment and consider pinning dependencies before installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/export_pdf.py:65
Finding

Unescaped Meeting Content Allows HTML Injection and Server-Side Resource Requests

Content
View full analysis
会议纪要 - {title_text} body {{ font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", "Microsoft YaHei", sans-serif; margin: 40px; line-height: 1.6; }} h1 {{ color: #333; border-bottom: 2px solid #4A90D9; padding-bottom: 10px; }} h2 {{ color: #555; margin-top: 30px; }} .meta {{ color: #666; margin-bottom: 20px; }} .meta-item {{ margin: 5px 0; }} .topic {{ background: #f8f9fa; padding: 15px; margin: 10px 0; border-radius: 5px; }} .topic-title {{ font-weight: bold; color: #333; }} .topic-conclusion {{ color: #4A90D9; margin-top: 5px; }} .todo-item {{ padding: 8px 0; border-bottom: 1px solid #eee; }} .todo-owner {{ color: #e67e22; font-weight: bold; }} .keyword {{ display: inline-block; background: #e8f4fd; padding: 3px 10px; margin: 3px; border-radius: 15px; font-size: 14px; }} table {{ width: 100%; border-collapse: collapse; margin-top: 15px; }} th, td {{ border: 1px solid #ddd; padding: 10px; text-align: left; }} th {{ background: #4A90D9; color: white; }} tr:nth-child(even) {{ background: #f9f9f9; }} .footer {{ margin-top: 40px; padding-top: 20px; border-top: 1px solid #ddd; color: #999; font-size: 12px; }}

📋 {title_text}

📅 时间：{meeting_info.get("time", "未指定")}
👥 参会人：{meeting_info.get("attendees", "未指定")}
""" if topics: html += "

📝 议题与结论

\n" for topic in topics: html += f"""
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
requirements.txt:5
Finding

Open-Ended and Unhashed Dependencies Expose Installation to Supply-Chain Risk

Content
View full analysis
=20231117 openai>=1.0.0 imageio-ffmpeg>=0.6.0 # Word / PDF 导出 python-docx>=1.1.0 weasyprint>=60.0 reportlab>=4.0.0 fpdf2>=2.7.0 ``` The documented installation instruction resolves these open-ended requirements directly: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every executable dependency is specified using only a minimum version. There is no upper bound, exact version, lock file, or package hash. Consequently, installations performed at different times can resolve to materially different dependency sets. A future compromised, malicious, or incompatible release can be selected automatically even though that release was never reviewed with this project. Python packages and their transitive dependencies execute code in the user's Python environment during installation or import. The project therefore relies on mutable external package contents without cryptographic integrity constraints. This finding does not establish that any listed package is currently malicious. The vulnerability is the absence of reproducible dependency resolution and integrity verification. ### Attack Path 1. A direct or transitive dependency account, build system, or distribution artifact is compromised. 2. A new affected version is published while still satisfying the project's `>=` constraint. 3. A user follows the documented `pip install -r requirements.txt` instruction. 4. The package resolver selects the affected version because no exact version or hash is required. 5. Malicious installation or runtime code executes with the privileges of the user operating the Python environment. ### Impact Assessment A successful supply-chain compromise could execute arbitrary Python or native code with the privileges of th ...[truncated 448 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (91)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill strongly markets itself as offline and privacy-safe, yet the documented default configuration sends meeting transcripts to OpenAI-compatible remote APIs. For a meeting-notes tool handling potentially sensitive recordings and transcripts, this mismatch can cause users to disclose confidential business data under a false expectation of local-only processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest emphasizes offline/privacy-safe operation, but the documented default notes-generation path sends transcript data to external LLM APIs. In the context of meeting recordings and notes, that can expose confidential internal discussions, personal data, or regulated information because users are likely to rely on the privacy claim.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill is marketed as local/offline and privacy-safe, but the default configuration targets a remote OpenAI-compatible API endpoint. In this context, meeting transcripts can contain sensitive business discussions, attendee identities, locations, and action items, so silently transmitting them off-device is a significant privacy and trust violation.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/input_validator.py (reported line 312)May include surrounding context.

python
print("测试 1: 音频路径验证")
    test_paths = [
        "valid.mp3",
        "../etc/passwd",  # 路径穿越
        "test.txt",  # 不支持的格式
        "x" * 300,  # 路径过长
    ]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

All instructions and prescribed reply phrases are presented only in Chinese, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. This can constitute a language/locale policy issue because the skill effectively mandates a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The quick-start guide materially contradicts the skill metadata by advertising cloud transcription and Feishu document delivery even though the manifest describes a local Whisper-based offline workflow with Word/PDF/email outputs. This can mislead users about where sensitive meeting audio and generated notes are sent, creating privacy, compliance, and trust risks if users rely on the documented 'offline/private' expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document presents the assistant as privacy-safe and offline while simultaneously offering a cloud transcription API option. For a meeting-notes assistant handling potentially confidential recordings, this inconsistency can cause users to submit sensitive audio to a remote service under a false assumption that processing remains local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The guide offers cloud transcription but does not place a clear warning at the decision point that audio may be uploaded to a remote service. In the context of meeting recordings, this is dangerous because users may unknowingly transmit confidential business discussions, personal data, or regulated information off-device.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The document instructs users to reply with “重新生成” or “调整格式” to cause the assistant to reprocess audio, but it does not define the exact context in which those phrases are recognized. Because the triggers are generic and no negative examples or boundary conditions are given, users may accidentally activate reprocessing in unrelated chat contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide says users can ask for help by replying with “帮助” or “问题”. These phrases are extremely generic and likely to appear in ordinary conversation, which creates a risk of unintended skill invocation or ambiguous routing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The plan explicitly changes generate_notes.py from local/rule-based processing to preferential use of an OpenAI-compatible remote API, while the skill metadata promises offline, privacy-safe handling. For meeting notes, transcripts can contain sensitive business, personal, or regulated information, so silently introducing remote transmission creates a real confidentiality and trust risk even if the feature is configurable.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented support for llm_base_url / llm_api_key / llm_model enables arbitrary OpenAI-compatible API calls that are not clearly necessary for a tool marketed around offline, privacy-safe meeting-note generation. In this context, that expands the data exposure surface and may route highly sensitive transcripts to third-party or self-hosted endpoints without clear user understanding.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The privacy policy is entirely in Chinese and does not state that it applies only to Chinese-speaking or China-based users. Users who cannot read Chinese may be unable to understand what data is processed locally versus sent to cloud transcription or LLM providers, undermining informed consent and increasing legal/compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The README instructs users to configure an external OpenAI-compatible endpoint for meeting-note generation, which can cause sensitive transcript text to be transmitted off-device despite the tool being marketed as local and privacy-safe. In the context of meeting recordings and notes, this is materially sensitive because transcripts may contain confidential business, legal, HR, or customer information.

Content

Scanner excerpt · README.md (reported line 131)May include surrounding context.

json
{
  "llm_base_url": "https://api.openai.com/v1",
  "llm_api_key": "sk-your-key-here",
  "llm_model": "gpt-4o-mini"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example promotes use of a third-party external API endpoint (DeepSeek-compatible) for transcript processing, creating the same outbound data-transfer risk as other cloud LLM integrations. Because the skill handles meeting content, the surrounding context makes external transmission more dangerous than in a generic text utility: users may assume privacy from the 'local/offline' positioning while inadvertently exporting sensitive discussions.

Content

Scanner excerpt · README.md (reported line 140)May include surrounding context.

国内兼容接口示例（通义千问、DeepSeek、智谱等）：

json
{
  "llm_base_url": "https://api.deepseek.com/v1",
  "llm_api_key": "sk-your-deepseek-key",
  "llm_model": "deepseek-chat"
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 237)May include surrounding context.

md
## 🌟 Star History

[![Star History Chart](https://api.star-history.com/svg?repos=jinzx/meeting-notes-assistant&type=Date)](https://star-history.com/#jinzx/meeting-notes-assistant&Date)

---

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation describes capabilities that imply shell execution, filesystem access, and environment/config handling, but it does not declare any explicit tool scope or permission boundaries. This creates a least-privilege failure: an agent may expose broader execution surfaces than users expect, increasing the chance of unintended file access, command execution, or secret handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest emphasizes offline/privacy-safe operation, but the documented default notes-generation path sends transcript data to external LLM APIs. In the context of meeting recordings and notes, that can expose confidential internal discussions, personal data, or regulated information because users are likely to rely on the privacy claim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.