Security audit

Bytesagain Meeting Minutes

Security checks for vulnerabilities and agentic risk

Overview

This is a local meeting-minutes tool, but it should be reviewed carefully because its sensitive file storage and export behavior are under-scoped and under-documented.

Install only if you are comfortable with meeting records being stored as local files and exported to a temporary system directory. Avoid using it for confidential meetings on shared machines unless the storage and export paths, file permissions, and meeting ID validation are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:72
Finding: Path Traversal Through Unvalidated Meeting Identifiers
Content: View full analysis
\"\" " && exit 1 local file="$STORE/$id.json" [ ! -f "$file" ] && echo "Meeting $id not found" && exit 1 MM_FILE="$file" MM_TITLE="$title" MM_STORE="$STORE" python3 << 'PYEOF' import json import os; path = os.environ.get("MM_FILE","") with open(path) as f: data = json.load(f) action = { "index": len(data["actions"]) + 1, "task": "$task", "owner": "$owner", "due": "$due", "status": "open" } data["actions"].append(action) with open(path, "w") as f: json.dump(data, f, indent=2, ensure_ascii=False) print(f"✅ Action #{action['index']} added to meeting $id") print(f" Task: $task") print(f" Owner: $owner | Due: $due") PYEOF } ``` ### Technical Analysis The meeting identifier is accepted directly from a command-line argument and concatenated into a filesystem path: ```bash local file="$STORE/$id.json" ``` No numeric-format validation, canonicalization, or containment check is performed. An identifier containing traversal sequences, such as `../../some/path/record`, can resolve outside `$HOME/.bytesagain-meetings`. The existence check does not prevent traversal because it evaluates the already-traversed path. Mutating commands subsequently open and rewrite the selected file through Python. The target must be accessible to the invoking account, end in `.json` after path construction, and contain the JSON structure expected by the selected command. The same unsafe pattern affects `add-action`, `add-decision`, `view`, `exp ...[truncated 1518 chars]
Remediation: View remediation
&2 exit 1 fi ``` 2. Canonicalize both the storage directory and candidate path, then verify containment: ```bash store_real=$(realpath "$STORE") file_real=$(realpath -m -- "$STORE/$id.json") case "$file_real" in "$store_real"/*.json) ;; *) echo "Meeting path escapes the storage directory" >&2 exit 1 ;; esac ``` 3. Pass paths and user-controlled values only through environment variables or Python arguments; do not interpolate them into Python source. 4. Apply the same validation helper consistently to `add-action`, `add-decision`, `view`, `export`, and `done`. 5. Add regression tests for identifiers containing `../`, absolute paths, symbolic-link paths, empty strings, separators, and nonnumeric characters. 6. Correct the existing undefined-variable failures, but do not expose the filesystem operations until path validation is in place. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/script.sh:8
Finding: Meeting Records May Be Created With Excessively Permissive Filesystem Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/script.sh:228
Finding: Predictable Shared Temporary Export Path Permits Symlink Overwrite
Content: View full analysis
.md` as a symbolic link to another file writable by the victim. When the victim exports that meeting, the process follows the link and overwrites the linked file with generated Markdown. The overwrite is constrained by the invoking user's permissions. It does not independently allow writing to root-owned files when the command runs as an unprivileged user. If the skill is invoked by a more privileged account or service, the potential target scope increases accordingly. The current `export` command references the undefined `$title` variable at line 195 under `set -u`, so it terminates before reaching this operation. The unsafe export primitive becomes exploitable if that unrelated failure is corrected without changing temporary-file handling. ### Attack Path 1. A local attacker determines or guesses a meeting identifier, such as `001`. 2. The attacker creates a symbolic link at `/tmp/meeting-001.md` pointing to a file writable by the victim. 3. The victim invokes `bytesagain-meeting-minutes export 001`. 4. The export code opens the predictable path using write mode. 5. Python follows the symbolic link and truncates the linked destination. 6. Generated meeting Markdown is written into the destination with the victim's privileges. ### Im ...[truncated 387 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared behavior does not fully match the described functionality, and the implementation reportedly performs persistent writes to locations like ~/.bytesagain-meetings and /tmp without clearly disclosing that storage behavior. Misstated capabilities and hidden persistence can cause users to expose sensitive meeting data under false assumptions, and code defects may further produce unsafe or unreliable handling of that data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises terminal-based meeting management and, by its nature, reads environment data and performs local file reads/writes, but it does not declare any tool scope or permissions boundary. This creates a transparency and least-privilege problem: users and hosting agents are not clearly informed that persistent local storage and filesystem access are required, which can lead to unintended exposure or modification of local data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Meeting minutes often contain sensitive business information, decisions, deadlines, and names, yet the skill does not warn users that data is stored locally. Without a clear notice, users may unintentionally place confidential material on shared systems, in insecure home directories, or in temporary export locations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.