Meeting Minutes CN

• Analyzed: May 11, 2026, 10:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: 61e893fa04d5e704ff4da44023bcaefcec180e3d1e61e582dc9e719fe2f315f3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates generating meeting minutes and syncing them to Feishu, but it contains a potential shell injection vulnerability in SKILL.md. The Feishu sync workflow instructs the agent to execute a python script using direct string interpolation for the document content (`--content "{minutes_content}"`), which could lead to arbitrary command execution if the meeting notes contain shell metacharacters. While no clear malicious intent or exfiltration was found, the insecure handling of user-provided content in a shell context is a high-risk flaw.