Security audit

meeting-summary

Security checks for vulnerabilities and agentic risk

Overview

This meeting-summary skill is not malicious, but it includes a persistent learning helper that can store notes/preferences and write state outside the immediate summarization task.

Install only if you are comfortable with a local learning file being created and updated. Avoid using the learner commands with confidential meeting material unless you control where learned_patterns.json is stored and are prepared to review or delete it; the action-extraction script alone is much lower risk.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill invokes local scripts including a self-learning workflow that records data and insights, which implies write capability even though no permissions are declared. This creates a transparency and governance gap: users and the platform may believe the skill is read-only, while it can persist data such as notes, error records, or preferences to disk.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill is presented as a meeting-summary assistant, but its documented workflow also records usage data, preferences, failures, and operational insights through the learner system. That mismatch can cause sensitive meeting content or metadata to be retained unexpectedly, violating user expectations and potentially exposing confidential business information beyond the summarization task.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This file implements a generic cross-skill persistent learning module inside a skill advertised only as a meeting-summary assistant. It records usage, errors, notes, and preferences over time, which materially expands the skill’s data collection and statefulness beyond the declared purpose and increases privacy and scope-creep risk, especially for meeting content that may contain sensitive business data.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code accepts an arbitrary skill directory or skill name under ~/.workbuddy/skills and then reads/writes learned_patterns.json there, enabling this meeting-summary skill’s helper to modify state for other skills. That cross-skill write capability violates least privilege and can enable unauthorized persistence, data contamination, or behavior shaping outside the meeting-summary context.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The module persistently stores user preferences, failure patterns, and free-form notes, none of which are clearly necessary for generating meeting summaries. In a meeting assistant context, those notes and preferences can easily include sensitive personal or organizational information, creating unnecessary retention and privacy exposure.

Static analysis

No suspicious patterns detected.