Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

MeetingClaw - Intelligent Meeting Minutes Assistant

v1.0.0

智能会议纪要生成工具,支持火山引擎录音文件识别2.0,自动生成结构化会议纪要。使用场景:(1) 上传音频文件生成会议纪要;(2) 语音转文字并智能总结;(3) 提取待办事项和核心观点;(4) 支持2小时以内音频处理。

0· 61·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name/description (meeting minutes from audio using 火山引擎) align with the code: it sends audio to Volcengine and calls a large model to generate minutes. However the registry metadata states "Required env vars: none" while SKILL.md and the script require VOLC_ACCESS_KEY and VOLC_SECRET_KEY — this is an important mismatch.
!
Instruction Scope
SKILL.md and the script instruct the agent to: accept an uploaded audio file, save it under a workspace path, send audio binary to Volcengine async transcribe API, then send the transcript to an OpenClaw model. SKILL.md claims audio and data are only sent to local and official servers, which is consistent with using Volcengine and OpenClaw, but SKILL.md also says the local path is '~/workspace/MeetingClaw/YYYYMMDD/' while the code writes to '~/.openclaw/workspace/MeetingClaw/YYYYMMDD' — a documentation/code mismatch. The standard (TOS) flow is documented but not implemented in code (standard mode raises '暂未实现').
Install Mechanism
No install spec (instruction-only + included script). That minimizes installer risk. The script imports 'volcengine' and 'openclaw' Python modules but no install instructions are provided — confirm those dependencies exist in runtime.
!
Credentials
The script legitimately requires VOLC_ACCESS_KEY and VOLC_SECRET_KEY to call Volcengine, which matches the purpose. The registry metadata incorrectly lists no required env vars; this discrepancy is suspicious and should be resolved. No other unrelated secrets are requested.
Persistence & Privilege
The skill does persist files locally under a user workspace (~/.openclaw/workspace/MeetingClaw) and has a 30-day retention/cleanup. always is false and the skill does not request elevated privileges or modify other skills. Writing into the user's home directory is expected but you should verify the path is acceptable for your environment.
What to consider before installing
Key things to check before installing: - Metadata mismatch: the skill metadata claims no required env vars, but SKILL.md and scripts require VOLC_ACCESS_KEY and VOLC_SECRET_KEY. Confirm the registry entry is accurate and the publisher can be trusted. - Data flows: audio is uploaded to Volcengine (official service) and transcripts are sent to the OpenClaw model API — if meetings contain sensitive data, ensure you are comfortable with those external services and their privacy terms. - Path & retention: the code saves audio and minutes under ~/.openclaw/workspace/MeetingClaw/YYYYMMDD and automatically deletes files older than 30 days. SKILL.md documents a different path; confirm where files will actually be stored and that retention meets your policy. - Dependencies: the script imports 'volcengine' and 'openclaw' but provides no install instructions; ensure these packages are installed from trusted sources and inspect them if needed. - Unimplemented standard mode: the 'standard' (TOS upload) flow is described in docs but not implemented in the script — treat that as incomplete functionality, not a feature. - Source trust: source/homepage unknown. Prefer skills with an identified publisher or open-source repo you can audit. If you decide to proceed, supply only credentials scoped to the minimal permissions required (audio transcription and TOS access if/when used), and consider testing with non-sensitive audio first.

Like a lobster shell, security has layers — review code before you run it.

ai-officevk977zrpbn7zp2p60qhc88wdk6s83bb06feishuvk977zrpbn7zp2p60qhc88wdk6s83bb06latestvk977zrpbn7zp2p60qhc88wdk6s83bb06meeting-minutesvk977zrpbn7zp2p60qhc88wdk6s83bb06productivityvk977zrpbn7zp2p60qhc88wdk6s83bb06speech-recognitionvk977zrpbn7zp2p60qhc88wdk6s83bb06volcenginevk977zrpbn7zp2p60qhc88wdk6s83bb06

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments