Meeting Assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:31 AM UTC
• Version: 1.0.4

Overview

This meeting assistant has a coherent purpose, but its recording daemon, installer, and calendar webhook expose more control and attack surface than a user should accept without review.

Review this before installing, especially on a shared Mac or work machine. It needs sensitive macOS permissions and background services for legitimate meeting automation, but the current package should restrict the audio daemon socket, authenticate webhook requests, remove eval from setup, avoid curl-to-bash installation, and avoid retaining plaintext OAuth client secrets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:52

Finding

Execution of a Mutable Remote Homebrew Installer

Content

View full analysis

/dev/null; then warn "Homebrew 未安装，正在安装..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" ok "Homebrew 已安装" else ok "Homebrew $(brew --version | head -1)" fi ``` ### Technical Analysis The installer downloads the current contents of Homebrew's mutable `HEAD` branch and passes the response directly to `/bin/bash`. It does not pin an immutable commit, verify a cryptographic digest or signature, or provide the user an opportunity to inspect the downloaded script. Although the URL points to the official Homebrew GitHub repository, the effective payload can change after this Skill has been reviewed. Compromise of the upstream repository, GitHub account, distribution path, or network trust chain could therefore turn a legitimate installation into arbitrary code execution. This behavior is not necessary for the Skill's core meeting-assistant functionality. Homebrew can instead be documented as a prerequisite and installed separately through a user-verified process. ### Attack Path 1. The user runs `scripts/setup.sh` on a system without Homebrew. 2. The script requests `install.sh` from the mutable `HEAD` branch. 3. The upstream response has changed or has been compromised. 4. The response is substituted directly into a shell command. 5. `/bin/bash` executes the remote payload with all privileges available to the installer process. 6. The remote script may also request elevated administrator privileges as part of its execution. ### Impact Assessment Successful exploitation permits arbitrary command execution as the installing user. The payload could access recordings, transcripts, calendar configuration, OAuth material readable by that user, and other user files. If the ...[truncated 118 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:294

Finding

Shell Command Injection Through the OAuth Credential Path

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/notify.py:25

Finding

AppleScript Injection Through Unescaped Meeting Titles and Messages

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/audio_daemon.swift:421

Finding

World-Writable Audio Daemon Socket Permits Unauthorized Recording and Window Inspection

Content

View full analysis

= 0 else { log("Socket: create failed"); return } var addr = sockaddr_un() addr.sun_family = sa_family_t(AF_UNIX) _ = SOCKET_PATH.path.withCString { strncpy(&addr.sun_path.0, $0, min(SOCKET_PATH.path.utf8.count, 103)) } let ok = withUnsafePointer(to: &addr) { $0.withMemoryRebound(to: sockaddr.self, capacity: 1) { Darwin.bind(sock, $0, socklen_t(MemoryLayout.size)) } } guard ok == 0 else { log("Socket: bind \(ok)"); close(sock); sock = -1; return } Darwin.listen(sock, 5); chmod(SOCKET_PATH.path, 0o666) log("Socket ready") DispatchQueue.global(qos: .background).async { [weak self] in while true { let c = Darwin.accept(self?.sock ?? -1, nil, nil) if c >= 0 { self?.handle(c); close(c) } } } } ``` The unauthenticated handler exposes sensitive actions: ```swift switch action { case "windows": resp = self.scanWindows() case "start": if !SYS_READY { resp = ["error":"sys_capture_not_ready", "sysReady": SYS_READY, "sysError": SYS_ERROR, "micReady": MIC_READY, "micError": MIC_ERROR] } else if !MIC_READY { resp = ["error":"mic_capture_not_ready", "sysReady": SYS_READY, "sysError": SYS_ERROR, "micReady": MIC_READY, "micError": MIC_ERROR] } else if let p = recorder.start(title: json["title"] as? String ?? "meeting") { resp = ["status":"recording", "file":p] } else { resp = ["error":"start_failed"] } case "stop": let (p, d) = recorder.stop(); resp = ["status":"stopped", "file": p ?? "", "duration": d] case "status": resp = ["recording": recorder.isRecording, "file" ...[truncated 2147 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:303

Finding

OAuth Client Secret Is Retained in a Plaintext Configuration File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_calendar_services.py:246

Finding

Public Calendar Webhook Accepts Unauthenticated Synchronization Triggers

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (141)

Tainted flow: 'req' from os.environ.get (line 76, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/webhook_server.py (reported line 81)May include surrounding context.

python

data=data,
        method="POST",
    )
    with urllib.request.urlopen(req, timeout=10) as resp:
        body = json.loads(resp.read())
    return body["access_token"]

Tainted flow: 'req' from os.environ.get (line 76, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/webhook_server.py (reported line 197)May include surrounding context.

python

method="POST",
        )
        try:
            with urlopen(req, timeout=15) as resp:
                data = json.loads(resp.read())
            # 7 天后过期
            expires = datetime.fromtimestamp(int(data["expiration"]) / 1000, tz=timezone.utc)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding is supported by the script inventory and installation text: the skill includes a webhook server, Google Calendar push watch registration, OAuth token use, local state writes, and inter-process signaling. In a meeting automation context, these are materially sensitive capabilities that should be explicitly disclosed and tightly controlled because they expand both network and privilege surfaces beyond simple local recording/transcription.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

If you are already inside the skill folder that contains `SKILL.md` and `scripts/`, you can run:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

## Google Calendar and Privacy

Calendar authorization uses `gog`; refresh tokens are stored in the system Keychain. The repository and skill package must never contain real `client_secret*.json`, refresh tokens, API keys, or personal calendar IDs.

Recommended setup:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

| `meeting_daemon.py` | Recording workflow control |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

| `meeting_daemon.py` | Recording workflow control |

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The UNIX socket is explicitly chmod'd to 0666, making it writable and readable by any local user/process. Any local process can issue start/stop/status/windows/quit commands, enabling unauthorized recording control, collection of window metadata, and denial of service against the daemon.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file starts system-audio capture and microphone capture automatically shortly after launch, with no user-facing confirmation in the daemon itself before capture infrastructure is activated. Given the skill's purpose is meeting recording/transcription, auto-starting capture components in the background increases the risk of covert or unexpected surveillance if another component triggers recording or if users misunderstand the daemon's behavior.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/check_meetings.py (reported line 93)May include surrounding context.

python

"--to", fmt_end,
        "--json",
    ]
    env = {**os.environ, "GOG_ACCOUNT": account}

    try:
        r = subprocess.run(cmd, capture_output=True, text=True, timeout=30, env=env)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_calendar_services.py (reported line 39)May include surrounding context.

python

WEBHOOK_PORT = 8899

# Google OAuth
# 从 gog 的 keychain 读取 OAuth 配置
# 或从环境变量读取

# 要 watch 的日历列表（从 config.json 加载）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_calendar_services.py (reported line 59)May include surrounding context.

python

WEBHOOK_PORT = 8899

# Google OAuth
# 从 gog 的 keychain 读取 OAuth 配置
# 或从环境变量读取

# 要 watch 的日历列表（从 config.json 加载）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run_calendar_services.py (reported line 61)May include surrounding context.

python

def _get_gog_credentials():
    """从 gog 的 keychain 读取 OAuth 凭证。
    用户需先运行：
      gog auth credentials ~/path/to/client_secret.json
      gog auth add <email> --services calendar
    也可通过环境变量手动指定。
    """

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 294)May include surrounding context.

sh

def _get_gog_credentials():
    """从 gog 的 keychain 读取 OAuth 凭证。
    用户需先运行：
      gog auth credentials ~/path/to/client_secret.json
      gog auth add <email> --services calendar
    也可通过环境变量手动指定。
    """

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 306)May include surrounding context.

sh

def _get_gog_credentials():
    """从 gog 的 keychain 读取 OAuth 凭证。
    用户需先运行：
      gog auth credentials ~/path/to/client_secret.json
      gog auth add <email> --services calendar
    也可通过环境变量手动指定。
    """

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 310)May include surrounding context.

sh

def _get_gog_credentials():
    """从 gog 的 keychain 读取 OAuth 凭证。
    用户需先运行：
      gog auth credentials ~/path/to/client_secret.json
      gog auth add <email> --services calendar
    也可通过环境变量手动指定。
    """

Static analysis

No suspicious patterns detected.