ClawHub
Back to skill

Security audit

AI Meeting Assistant — Jitsi Meet & Google Meet

Security checks for vulnerabilities and agentic risk

Overview

This meeting assistant is not malicious, but it needs review because it can join live meetings and capture audio/chat without clear consent or confirmation safeguards.

Review before installing. Use this only where you are allowed to bring a bot into the meeting, notify participants, and send meeting audio/chat/transcripts to the configured gateway and AI providers. Prefer explicit prompts such as join/transcribe this specific meeting URL, and avoid relying on broad automatic triggers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Content
### 🚀 Quick Onboarding

1. **Get your Habilis MCP Token**:
   - Go to [https://<your-domain>](https://<your-domain>) and generate your access token.

2. **Set Environment Variables**:
   ```bash
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill description explains functionality but does not clearly warn users that the agent may join a live meeting, capture participant audio and chat, transcribe speech, and generate minutes. In a meeting-assistant context this omission is especially risky because users may invoke the skill without understanding the privacy, consent, and legal implications for all participants.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The README advertises transcription, diarization, voice interaction, and chat capture, but it does not clearly and prominently warn that live meeting audio, transcript data, and chat content are transmitted to external services such as the MCP gateway and third-party AI/voice providers. In a meeting-assistant context, this omission is security-relevant because users may unknowingly expose sensitive business or personal communications to external processors, creating consent, privacy, and compliance risks.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The triggers `jitsi` and `google meet` are overly broad and likely to match ordinary user mentions of those platforms rather than an explicit request to summon a meeting bot. In this skill’s context, accidental activation is more dangerous because the advertised behavior includes joining live meetings, capturing audio/chat, and producing transcripts, which could cause unintentional participation and privacy violations.

Vague Triggers

Low
Confidence
90% confidence
Finding
This manifest describes a meeting bot with extensive capabilities, but it does not specify when the skill should or should not be invoked, nor does it list concrete trigger phrases or scope limits. In a manifest file, that lack of specificity can create ambiguous activation conditions and unintended invocation overlap with other meeting-related requests.

Natural-Language Policy Violations

Low
Confidence
66% confidence
Finding
The natural-language description emphasizes real-time transcription, speaker diarization, duplex voice, and meeting-minute generation, but it does not mention whether language or locale is user-selectable. For speech and transcription skills, silently defaulting to a language or locale can create policy issues if the user is not given an opt-in choice.

Static analysis

No suspicious patterns detected.