ClawHub
Back to skill

Security audit

Meeting Summarizer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent, but it should be reviewed because its sample helper uploads meeting audio to SenseAudio and enables extra sensitive analysis by default.

Install only if you are comfortable sending meeting recordings and the API key to SenseAudio. For confidential meetings, confirm participant permission and provider retention terms, and adjust the helper so sentiment, diarization, and word-level timestamps are enabled only when explicitly needed. Pin dependency versions before using this in a controlled environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding
Unpinned Third-Party Runtime Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 13-16 **Vulnerability Type**: Unconstrained dependency resolution **Risk Level**: Medium ### Evidence ```yaml install: - kind: uv package: requests - kind: uv package: websockets ``` ### Technical Analysis The Skill declares the third-party `requests` and `websockets` packages without version constraints, integrity hashes, or a lockfile. Each installation can therefore resolve to a different package version. A future compromised, malicious, or incompatible release could execute code during installation or when imported at runtime. The package names correspond to established Python projects, and the reviewed content does not specify an untrusted package source or demonstrate dependency confusion. The risk arises from unconstrained future dependency resolution rather than evidence that the currently named packages are malicious. ### Attack Path 1. An attacker compromises a future release, distribution account, or package-resolution path associated with one of the dependencies. 2. A user installs the Skill after the compromised release becomes the version selected by the resolver. 3. The package is installed without a reviewed version or integrity check. 4. Malicious package initialization, installation, or imported runtime code executes under the privileges of the user or Agent process. ### Impact Assessment Successful exploitation could allow arbitrary code execution with the privileges of the process installing or running the Skill. Depending on the surrounding environment, this could expose accessible files, environment variables such as `SENSEAUDIO_API_KEY`, transcript data, and network resources. The Skill itself does not request elevated operating-system privileges, so the direct scope is limited to the privileges already held by the Agent or user process.
Remediation
## Remediation Suggestions - Pin each dependency to an explicitly reviewed version. - Use a lockfile that records the complete resolved dependency graph. - Require cryptographic hashes for downloaded distributions where supported. - Resolve packages only through an approved and authenticated package index. - Add automated vulnerability and integrity scanning for direct and transitive dependencies. - Establish a controlled update process that reviews and tests new versions before changing the pins.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:75
Finding
Sensitive Meeting Analysis Features Enabled by Default## Vulnerability Details **File Location**: `SKILL.md`, lines 75-90 **Vulnerability Type**: Excessive processing of sensitive meeting data **Risk Level**: Medium ### Evidence ```python def transcribe_meeting(audio_file, max_speakers=None, language=None, target_language=None): with open(audio_file, "rb") as handle: response = requests.post( API_URL, headers={"Authorization": f"Bearer {API_KEY}"}, files={"file": handle}, data={ "model": "sense-asr-pro", "response_format": "verbose_json", "enable_speaker_diarization": "true", "enable_sentiment": "true", "enable_punctuation": "true", "timestamp_granularities[]": ["word", "segment"], **({"max_speakers": max_speakers} if max_speakers else {}), **({"language": language} if language else {}), **({"target_language": target_language} if target_language else {}), }, timeout=300, ) ``` ### Technical Analysis The helper always uploads the selected meeting recording to the declared SenseAudio endpoint and requests speaker diarization, sentiment analysis, and word-level and segment-level timestamps. Uploading audio to the ASR provider is consistent with the Skill's declared cloud-transcription function, and the API credential is transmitted through a TLS-protected Authorization header rather than a query parameter. However, the helper does not implement the Skill's own least-processing rule that diarization, timestamps, and sentiment should be enabled only when needed. A user requesting only basic transcription may therefore cause the provider to derive additional speaker, emotional, and fine-grained temporal information. Sentiment analysis in particular is not necessary for ordinary transcription and can produce sensitive or inaccurat ...[truncated 1832 chars]
Remediation
## Remediation Suggestions - Add explicit options such as `enable_diarization=False`, `enable_sentiment=False`, and `timestamp_granularities=None`. - Enable each optional analysis feature only when the user requests it or when it is strictly necessary for the requested output. - Obtain explicit confirmation before uploading a meeting recording and clearly state that transcription is performed by an external cloud provider. - Explain what categories of data will be transmitted and which optional metadata will be derived. - Default to segment timestamps or no timestamps unless word-level timing is required. - Avoid sentiment analysis by default and warn users that sentiment inference may be sensitive or inaccurate. - Minimize retention of provider identifiers, transcripts, speaker metadata, and local temporary files. - Document provider retention and deletion controls where available.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
Use the official SenseAudio ASR rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/audio/transcriptions`
- WebSocket endpoint: `wss://api.senseaudio.cn/ws/v1/audio/transcriptions`
- File upload limit: `<=10MB` per request
- Meeting-oriented HTTP model: `sense-asr-pro`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
Use the official SenseAudio ASR rules summarized below:

- HTTP endpoint: `POST https://api.senseaudio.cn/v1/audio/transcriptions`
- WebSocket endpoint: `wss://api.senseaudio.cn/ws/v1/audio/transcriptions`
- File upload limit: `<=10MB` per request
- Meeting-oriented HTTP model: `sense-asr-pro`
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.