Security audit

skill-c-fetch-minutes

Security checks for vulnerabilities and agentic risk

Overview

This skill matches a real meeting-minutes automation workflow, but it needs review because it can broadly scan and modify Gitea repositories and its default setup can send tokens and meeting data over plaintext HTTP.

Install only in the intended controlled AIFusion environment. Before use, change Gitea to HTTPS, use a repo-scoped bot token, add an explicit repository allowlist, run dependencies in a virtual environment with pinned versions, constrain commit-content input files to a controlled temp directory, and enforce valid meeting state transitions before remote writes. Rotate any token that was used with the supplied HTTP endpoint.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: env-example.txt:1
Finding: Gitea credentials and confidential meeting content are transmitted over plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/commit_content.py:147
Finding: Caller-controlled file paths allow arbitrary local files to be uploaded to Gitea
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/gitea_utils.py:136
Finding: Scanner enumerates every token-visible repository and exposes excessive meeting data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/commit_content.py:203
Finding: Content commit operation can bypass required meeting workflow states
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: setup.sh:12
Finding: Unpinned dependencies are forcibly installed into the system Python environment
Content: View full analysis
=2.28.0 python-dotenv>=1.0.0 PyYAML>=6.0 pytz>=2023.3 python-dateutil>=2.8.2 ``` ### Technical Analysis The setup process installs dependencies into the system-managed Python environment and explicitly bypasses package-manager protections with `--break-system-packages`. Dependencies are not pinned to exact reviewed versions and no integrity hashes are supplied. As a result, the effective installed code can change over time without any change to the audited Skill. Installation behavior also depends on the caller's configured package index. A compromised future package release, compromised index, or incompatible update could execute during installation or when imported by the Skill. ### Attack Path 1. A user runs `setup.sh`. 2. `pip` resolves the latest versions satisfying the open-ended lower bounds. 3. Resolution uses the caller's configured package source and does not verify project-supplied hashes. 4. A compromised, substituted, or incompatible release is installed into the system Python environment. 5. Installation hooks or imported package code execute with the privileges of the user running the Skill. 6. Because installation is system-wide, the package can also affect unrelated Python applications. ### Impact Assessment A dependency compromise could execute arbitrary code with the setup user's privileges and access the Gitea token, meeting content, local files, and network. Even without a malicious package, forced system-wide installation can destabil ...[truncated 51 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/set_failed.py:34
Finding: Unescaped meeting metadata permits HTML injection in notification emails
Content: View full analysis

⚠️ Meeting transcript retrieval timed out; manual upload is required

Meeting topic {topic}
Organizer {organizer}
Project {repo}
{transcript_url} """ ``` ### Technical Analysis Values originating from repository metadata or command-line arguments are insert ...[truncated 1126 chars]
Remediation: View remediation
`, `"`, `'`, and `&` in every interpolated field. - Apply defense-in-depth sanitization before handing HTML to the email-sending component. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is about a specific business workflow: post-meeting retrieval of Tencent Meeting transcripts/minutes, issue extraction, generation of draft artifacts, and organizer notification. The supplied code does none of those things. Instead, it implements a generic logging helper that reads an existing file from a Gitea repo, appends a JSON line, and writes it back. While committing files to Gitea could be a supporting detail in the broader skill, this chunk's actual purpose is persistent logging, which is not mentioned in the declared description and is materially different from the stated meeting-minute and issue-generation workflow. Therefore this code chunk does not accurately represent the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a post-meeting automation that fetches Tencent Meeting artifacts, performs AI issue extraction, writes draft_issue.md and other files, commits them, and notifies the organizer. The supplied code does none of those main actions. Instead, it is an inventory/scan step that traverses managed repositories, reads meetings/*/meta.yaml, computes whether meetings are ready for post-processing, groups them into A/B/C classes, and outputs structured JSON for downstream use. While scanning may be a supporting part of a larger workflow, this chunk materially differs from the declared purpose because its primary behavior is repository state discovery and classification, including email lookup and manual transcript recovery detection. It also references 'brief-sent' state despite the declaration saying pre-meeting brief scenarios are out of scope. Therefore this code chunk does not accurately match the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents the skill as the main automated post-meeting processing pipeline: retrieve transcript and AI minutes from Tencent Meeting, extract issues, generate draft artifacts, commit them, and notify for review. The actual code chunk does none of those core tasks. Instead, it implements a narrow failure-path helper that marks a meeting as transcript-failed when transcript retrieval has timed out, writes a log, and prepares an email asking the organizer to manually upload the transcript. While this may be related to the broader meeting-minutes workflow, it is a materially different primary purpose and includes undeclared behavior (state transition to transcript-failed and manual remediation email generation). Therefore this code chunk does not accurately match the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose describes a downstream post-meeting content-processing pipeline: retrieve transcript/minutes, extract issues, generate files, commit them, and notify reviewers. The code shown instead implements a state gatekeeper that advances a meeting into waiting-transcript only after scheduled end time plus 20 minutes. While this could be part of a larger pipeline, the actual chunk’s primary function is status transition and safety validation, which is not represented in the declared description. It also lacks the main declared capabilities entirely: no Tencent Meeting access, no transcript retrieval, no issue extraction, no draft file generation, and no organizer notification. Therefore the code chunk does not accurately match the declared purpose.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/commit_content.py (reported line 40)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/commit_content.py (reported line 178)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/scan.py (reported line 31)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/scan.py (reported line 222)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/set_failed.py (reported line 23)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/set_waiting.py (reported line 28)May include surrounding context.
python
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · setup.sh (reported line 6)May include surrounding context.
sh
SKILL_DIR="$(cd "$(dirname "$0")" && pwd)" CONFIG_DIR="$HOME/.config/skill-c-fetch-minutes" ENV_FILE="$CONFIG_DIR/.env" echo "🚀 设置 Skill-C (fetch_minutes)..." echo ""

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is written entirely in Chinese and describes the skill behavior without indicating any user language choice or opt-in. Under the policy rule for natural-language violations, this is a locale/language constraint that appears implicit rather than documented as an optional or region-specific setting.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Comments and command descriptions intended for operators are written in Chinese, and the CLI usage/help text also uses Chinese for operational details. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The usage block is what end users see when invoking the CLI, and its command explanations are only in Chinese. Because no language choice or documented locale limitation is provided, this is a natural-language policy violation under the locale rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The email instruction explicitly tells users to confirm by saying a fixed Chinese phrase: "确认 {meeting_dir} 的 issue". This imposes a specific language on the user, and the file does not offer a language choice or explain a justified region-specific requirement, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This file contains functions that create and update repository files via Gitea API calls, which can modify user or project data remotely. Although the functions are named descriptively, there is no confirmation prompt, visible user disclosure, or warning in comments/docstrings for the destructive side effect of writing to a repository.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function get_managed_repos enumerates all repositories visible to the provided Gitea token and filters them by presence of a meetings directory, which exceeds the narrowly described purpose of processing known meeting repositories. In a scheduled automation context, broad repository discovery expands the blast radius of a compromised or overprivileged token and enables unintended access mapping across the entire Gitea instance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code fetches and then writes log content to a remote repository API using authenticated HTTP requests, which can transmit user or system data contained in entry. There is no confirmation prompt, print/log disclosure, or inline warning indicating that runtime events are being sent off-host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script forces all time parsing and current-time comparisons to use Asia/Shanghai. This is a locale-specific behavior, and the file does not offer user opt-in or explain that the skill is intended only for a China-based environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script emits organizer_email and attendee_emails for every matched meeting into its JSON output. That creates unnecessary exposure of personally identifiable information to any downstream consumer, logs, schedulers, or operators that can read task output, expanding the blast radius beyond the Gitea API call that originally required the data.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.sh (reported line 19)May include surrounding context.
sh
if [ ! -f "$ENV_FILE" ]; then cp "$SKILL_DIR/env-example.txt" "$ENV_FILE" chmod 600 "$ENV_FILE" echo "" echo "📝 已创建配置文件：$ENV_FILE" echo "请编辑该文件，至少填入："

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comment on L5 is written only in Chinese, which imposes a specific language in natural-language content without offering an alternative or user opt-in. This can violate language/locale policy expectations for broadly usable skills or configuration examples.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or incompatible releases into an automation skill that fetches meeting data and writes artifacts to Gitea.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0 python-dotenv>=1.0.0 PyYAML>=6.0 pytz>=2023.3

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: Requests has multiple known advisories, and because the manifest does not pin a specific version, it is impossible to verify whether the installed release is affected. This skill likely performs outbound API calls and may handle authentication material, so an affected requests version could expose credentials or weaken transport security.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: main.js:32

Meeting topic	{topic}
Organizer	{organizer}
Project	{repo}

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

⚠️ Meeting transcript retrieval timed out; manual upload is required

SkillSpector

Tp4

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Missing User Warnings

Context-Inappropriate Capability

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

Sudo/Root Execution

Natural-Language Policy Violations

Unpinned Dependencies

Static analysis

Shell command execution detected (child_process).