Meeting Summarizer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:44 AM UTC
• Version: 1.0.2

Overview

The skill is mostly coherent, but it should be reviewed because its sample helper uploads meeting audio to SenseAudio and enables extra sensitive analysis by default.

Install only if you are comfortable sending meeting recordings and the API key to SenseAudio. For confidential meetings, confirm participant permission and provider retention terms, and adjust the helper so sentiment, diarization, and word-level timestamps are enabled only when explicitly needed. Pin dependency versions before using this in a controlled environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-16
Vulnerability Type: Unconstrained dependency resolution
Risk Level: Medium

Evidence

yaml

install:
  - kind: uv
    package: requests
  - kind: uv
    package: websockets

Technical Analysis

The Skill declares the third-party requests and websockets packages without version constraints, integrity hashes, or a lockfile. Each installation can therefore resolve to a different package version. A future compromised, malicious, or incompatible release could execute code during installation or when imported at runtime.

The package names correspond to established Python projects, and the reviewed content does not specify an untrusted package source or demonstrate dependency confusion. The risk arises from unconstrained future dependency resolution rather than evidence that the currently named packages are malicious.

Attack Path

1. An attacker compromises a future release, distribution account, or package-resolution path associated with one of the dependencies.
2. A user installs the Skill after the compromised release becomes the version selected by the resolver.
3. The package is installed without a reviewed version or integrity check.
4. Malicious package initialization, installation, or imported runtime code executes under the privileges of the user or Agent process.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of the process installing or running the Skill. Depending on the surrounding environment, this could expose accessible files, environment variables such as SENSEAUDIO_API_KEY, transcript data, and network resources. The Skill itself does not request elevated operating-system privileges, so the direct scope is limited to the privileges already held by the Agent or user process.

Remediation

View remediation

Remediation Suggestions

• Pin each dependency to an explicitly reviewed version.
• Use a lockfile that records the complete resolved dependency graph.
• Require cryptographic hashes for downloaded distributions where supported.
• Resolve packages only through an approved and authenticated package index.
• Add automated vulnerability and integrity scanning for direct and transitive dependencies.
• Establish a controlled update process that reviews and tests new versions before changing the pins.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:75

Finding

Sensitive Meeting Analysis Features Enabled by Default

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75-90
Vulnerability Type: Excessive processing of sensitive meeting data
Risk Level: Medium

Evidence

python

def transcribe_meeting(audio_file, max_speakers=None, language=None, target_language=None):
    with open(audio_file, "rb") as handle:
        response = requests.post(
            API_URL,
            headers={"Authorization": f"Bearer {API_KEY}"},
            files={"file": handle},
            data={
                "model": "sense-asr-pro",
                "response_format": "verbose_json",
                "enable_speaker_diarization": "true",
                "enable_sentiment": "true",
                "enable_punctuation": "true",
                "timestamp_granularities[]": ["word", "segment"],
                **({"max_speakers": max_speakers} if max_speakers else {}),
                **({"language": language} if language else {}),
                **({"target_language": target_language} if target_language else {}),
            },
            timeout=300,
        )

Technical Analysis

The helper always uploads the selected meeting recording to the declared SenseAudio endpoint and requests speaker diarization, sentiment analysis, and word-level and segment-level timestamps. Uploading audio to the ASR provider is consistent with the Skill's declared cloud-transcription function, and the API credential is transmitted through a TLS-protected Authorization header rather than a query parameter.

However, the helper does not implement the Skill's own least-processing rule that diarization, timestamps, and sentiment should be enabled only when needed. A user requesting only basic transcription may therefore cause the provider to derive additional speaker, emotional, and fine-grained temporal information. Sentiment analysis in particular is not necessary for ordinary transcription and can produce sensitive or inaccurat ...[truncated 1832 chars]

Remediation

View remediation

Remediation Suggestions

• Add explicit options such as enable_diarization=False, enable_sentiment=False, and timestamp_granularities=None.
• Enable each optional analysis feature only when the user requests it or when it is strictly necessary for the requested output.
• Obtain explicit confirmation before uploading a meeting recording and clearly state that transcription is performed by an external cloud provider.
• Explain what categories of data will be transmitted and which optional metadata will be derived.
• Default to segment timestamps or no timestamps unless word-level timing is required.
• Avoid sentiment analysis by default and warn users that sentiment inference may be sensitive or inaccurate.
• Minimize retention of provider identifiers, transcripts, speaker metadata, and local temporary files.
• Document provider retention and deletion controls where available.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

Use the official SenseAudio ASR rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/audio/transcriptions`
- WebSocket endpoint: `wss://api.senseaudio.cn/ws/v1/audio/transcriptions`
- File upload limit: `<=10MB` per request
- Meeting-oriented HTTP model: `sense-asr-pro`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

Use the official SenseAudio ASR rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/audio/transcriptions`
- WebSocket endpoint: `wss://api.senseaudio.cn/ws/v1/audio/transcriptions`
- File upload limit: `<=10MB` per request
- Meeting-oriented HTTP model: `sense-asr-pro`