Security audit
Security checks for vulnerabilities and agentic risk
This meeting-bot skill is purpose-aligned but needs Review because it can join meetings, transcribe sensitive conversations, save transcripts locally, and use callback URLs without enough consent, retention, or trust-boundary guidance.
Before installing, confirm this skill will only join meetings where participants have consented to a bot and transcription. Use only trusted HTTPS callback endpoints, avoid sending full transcripts externally unless necessary, and decide where local transcripts are stored, who can read them, and when they are deleted.
The skill describes real-time meeting transcription and saving local records without any notice about consent, sensitive data handling, retention, or access controls. In a meeting-bot context, this can capture confidential conversations and personal data, creating significant privacy, legal, and data leakage risk if used without explicit participant awareness and proper safeguards.
The description says the skill is suitable for scenes needing 'join meeting' related capability and related development scenarios, but it does not define specific trigger phrases, scope boundaries, or exclusion conditions. In a markdown skill file, this kind of broad invocation language can overlap with common requests about meetings and may cause unintended activation.
Documenting a callback_url for asynchronous completion without warning that results may be sent to an external endpoint can lead users to unintentionally exfiltrate meeting metadata or transcript content. In this skill's context, callback destinations may receive sensitive meeting outputs, so omission of trust-boundary guidance is security-relevant.
No suspicious patterns detected.
