ClawHub
Back to skill

Security audit

Meeting to Action Items

Security checks across malware telemetry and agentic risk

Overview

This skill locally turns meeting or chat text into structured action items, and the reviewed artifacts do not show hidden access, persistence, or unsafe behavior.

Install this if you want meeting notes, chat logs, or transcripts converted into project-style action items. Review generated owners, deadlines, priorities, and risks before treating them as commitments, especially when your original request was only for a general summary.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The skill description and activation wording are broad enough to match common requests like summarizing meetings or extracting tasks, which can cause unintended invocation instead of a more appropriate generic summarization flow. This is not code-execution dangerous, but it can lead to over-collection, incorrect transformation of user data into structured project state, and surprising behavior when the user did not explicitly ask for this format.

Vague Triggers

Low
Confidence
82% confidence
Finding
The listed trigger phrases lack boundaries and exclusion rules, so ordinary requests like '总结这个会议' may invoke the skill even when the user only wants a narrative summary. In this context, the danger is mainly misrouting and output mismatch rather than direct security compromise, but it still creates reliability and privacy-risk concerns because more structure and inference may be applied than the user intended.

Natural-Language Policy Violations

Medium
Confidence
78% confidence
Finding
The skill forces a language/format rule ('input in Chinese => output fully in Chinese while headings remain English') without clear user opt-in. This can override user expectations or system-level formatting needs, and in multilingual enterprise settings it may cause accidental disclosure, workflow breakage, or noncompliant output formatting when the user wanted a different language or style.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.