Andara Meeting Minutes

Capture meeting summaries and action items from voice or text

Security Scan

The skill's stated purpose (capture meeting minutes) is plausible, but its runtime instructions reference a PostgreSQL database and the psql binary without declaring the required environment variable or binaries, and they show unsafe shell/SQL usage — these inconsistencies and injection/exfiltration risks should be resolved before use.

Purpose & Capability

The skill's purpose (capture meeting summaries/action items) legitimately may need a database. However, the SKILL.md expects a PostgreSQL connection (psql + $DATABASE_URL) even though the skill metadata declares no required env vars or binaries. That mismatch is incoherent: a DB URL and psql are expected for the stated functionality but are not declared.

Instruction Scope

Instructions tell the agent to parse user messages and execute psql commands via bash with data interpolated into SQL. The examples show direct substitution of parsed text into SQL executed in a shell, which is vulnerable to SQL injection and could leak arbitrary message contents to any database the agent can reach. The instructions do not specify input sanitization, parameterized queries, or limits on what is stored.

Install Mechanism

There is no install spec (instruction-only), which lowers install risk, but the runtime depends on the psql client being present and a reachable PostgreSQL endpoint. The metadata did not declare psql as a required binary or provide an install path, creating an operational and security blind spot.

Credentials

The SKILL.md relies on $DATABASE_URL (a credential/connection string) but the skill declares no required environment variables or primary credential. Requesting access to a database connection is proportionate for storing meetings, but the omission in metadata is a mismatch and a red flag—users would not be prompted to provide or review the DB credential beforehand.

Persistence & Privilege

always is false and the skill is user-invocable; it does not request permanent 'always' presence or other elevated platform privileges. Autonomous invocation is allowed (platform default) but not in itself unusual.

What to consider before installing

Before installing or enabling this skill, ask the developer to: 1) explicitly declare required binaries and environment variables (psql and DATABASE_URL) in the metadata; 2) provide a safer insertion method (use parameterized queries or a DB client library rather than constructing SQL inside bash) to eliminate SQL injection risk; 3) explain what data is stored and for how long, and ensure the DB uses least-privilege credentials (an insert-only, limited-scope role on a non-production/test DB first); 4) confirm the psql binary requirement and network access rules (which hosts/ports the skill will connect to); and 5) consider alternative designs that don't require direct DB credentials in the agent (e.g., a backend service or sanitized API). If the developer cannot supply these clarifications, treat the skill as unsafe to enable with access to any production database or sensitive meeting content.

Meeting Minutes Skill

When ATTi or a team member sends a meeting summary (voice or text), save it as a structured record.

Trigger

When user says something like "Meeting Notes:", "Besprechungsnotizen:", or "save meeting" — parse the content and store it.

Steps

1. Extract the meeting topic, attendees, decisions, and action items from the message.

2. Save to PostgreSQL using bash + psql:

psql "$DATABASE_URL" -c "
INSERT INTO team_meetings (title, summary, attendees, meeting_date, created_at)
VALUES ('TOPIC', 'SUMMARY', ARRAY['ATTENDEE1','ATTENDEE2'], NOW(), NOW())
RETURNING id;"

3. For each action item, insert into meeting_action_items:

psql "$DATABASE_URL" -c "
INSERT INTO meeting_action_items (meeting_id, assignee, description, due_date, status, created_at)
VALUES (MEETING_ID, 'ASSIGNEE', 'TASK DESCRIPTION', 'DUE_DATE', 'pending', NOW());"

4. Confirm to the user: "Meeting gespeichert ✅ — [X] Action Items erstellt."

Output Format

Reply in German with a structured summary:

• 📋 Meeting: [Title]
• 👥 Teilnehmer: [Names]
• ✅ Action Items: [List with assignees]
• 📅 Nächstes Treffen: [if mentioned]