Security audit

ai-meeting-notes

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for meeting notes, but it auto-saves raw pasted content while also telling users that nothing is stored.

Review before installing. Use this only in workspaces where saved meeting notes and todo files are appropriate, and avoid pasting secrets, HR/legal discussions, customer data, or private transcripts unless you are comfortable with raw content being retained locally.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Ssd 3

High

Confidence: 97% confidence
Finding: The explicit instruction to preserve the original input exactly as pasted means any sensitive information in transcripts or copied notes will be written verbatim to disk. In the context of a meeting-notes skill, users are especially likely to include confidential business discussions, customer data, or personal information, so exact retention substantially raises the privacy and data leakage risk.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The FAQ explicitly tells users that nothing is stored, but the skill instructions direct the agent to save meeting notes, raw pasted content, and to-do data into workspace files. This creates a material mismatch between user expectations and actual data handling, which can lead users to paste sensitive transcripts, internal discussions, or personal data under false privacy assumptions.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The manifest description and later prose present the skill as applicable to virtually any text, not just clearly bounded meeting-note inputs. This broad scope makes it unclear when the skill should activate versus when a generic summarization or text-processing skill should be used.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill description emphasizes convenience and broad input support but does not prominently warn that pasted notes and transcripts are automatically saved, potentially with raw content preserved. Users may therefore disclose confidential meeting material without informed consent, making this a transparency and data-handling vulnerability.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Requiring preservation and storage of the user's full raw meeting input increases the risk of retaining secrets, personal data, legal discussions, credentials pasted by mistake, or other sensitive content far beyond what is needed for a summary. Long-term retention and later retrieval enlarge the exposure surface if the workspace is shared, synced, or inspected by other tools.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill says 'Just paste your notes and ask' and lists broad phrases like 'Summarize this meeting...' and 'Parse these notes...' without defining clear activation boundaries or exclusions. In a markdown skill description, this can cause unintended invocation because these phrases are common user requests that are not uniquely scoped to this specific skill.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The example explicitly promotes saving meeting notes, transcripts, attendee names, action items, and business details to persistent files and a to-do list, but provides no warning, consent guidance, retention limits, or handling precautions for sensitive personal or confidential corporate information. Because meeting notes commonly contain internal plans, customer issues, staffing details, and other sensitive data, normalizing automatic storage without privacy safeguards can lead to unintended disclosure or over-retention.

Static analysis

No suspicious patterns detected.