Security audit

AI会议助手免费版

Security checks for vulnerabilities and agentic risk

Overview

This meeting-bot skill is coherent with its stated purpose, but it needs review because it can join and record meetings while consent, retention, transcript access, sharing, and credential handling are under-specified.

Review this before installing if you plan to use it in real meetings. Only use it where every required participant has been notified and consented, avoid confidential or regulated meetings unless your organization permits it, store transcripts and summaries carefully, restrict who can access them, and prefer an environment variable or secret manager over the plaintext config file. Install dependencies in an isolated environment and pin versions if you proceed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:154
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:167
Finding: API Key Stored in a Plaintext Configuration File Without Access Controls
Content: View full analysis
./config/agentcall/config.json << 'EOF' {"api_key": "your_api_key_here"} EOF ``` ### Technical Analysis The documented configuration procedure writes a reusable API key to a plaintext file. It does not set restrictive directory or file permissions, use a secret-management facility, or instruct users to exclude the credential from version control. Actual exposure depends on the host's default permission mask and repository practices. On a permissively configured system, another local account may be able to read the file. The credential could also be captured through source-control commits, backups, support bundles, workspace synchronization, or other processes that collect project files. No real credential is hardcoded in the submitted artifact; the demonstrated value is a placeholder. The risk arises when a user replaces that placeholder with a valid key as instructed. ### Attack Path 1. A user substitutes a valid API key and executes the documented configuration procedure. 2. The valid key is written unencrypted to `./config/agentcall/config.json`. 3. The file receives permissions derived from the user's default permission mask, with no explicit hardening. 4. Another local user or a process with access to the workspace, backups, synchronized files, or repository history obtains the file. 5. The exposed key is reused to access the associated meeting-bot service until it expires or is revoked. ### Impact Assessment An attacker obtaining the key may be able to consume the associated service quota and perform operations authorized to that credential. The exact privileges cannot be established because the artifact does not document the service API's authorization model. This issue does not directly provide operating-system privi ...[truncated 137 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill markets a bot that can join meetings, listen continuously, and transcribe content, but it does not prominently warn users about participant consent, recording laws, or the sensitivity of meeting data. In this context, omission of privacy and consent safeguards is dangerous because users may deploy the bot into meetings containing confidential, personal, financial, or regulated information without lawful notice or authorization.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger condition is defined so broadly ('需要AI模型调用、智能对话、Agent编排、LLM应用时使用') that an agent could invoke this skill for many unrelated tasks, then obtain permission to use exec/read/write and process meeting links or sensitive context unexpectedly. In this skill, broad invocation is especially risky because the documented capability includes joining live meetings, capturing audio, and generating transcripts, so accidental activation can create privacy and consent violations rather than a mere UX issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The display name, summary, and the rest of the skill instructions are presented in Chinese, but the document does not state that the skill is intentionally limited to Chinese-speaking users or offer an alternative language option. Per the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill explicitly describes end-to-end listening, transcription, and post-meeting extraction of decisions, action items, and owners, which normalizes bulk capture of meeting content without embedding safeguards. In a meeting-assistant context this functionality is expected, but it becomes dangerous when the document does not limit collection, require consent, or define retention and access controls for the captured data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Real-time saving of transcripts with retrospective access increases the exposure window for sensitive spoken content and creates a persistent record that can be misused or leaked. In this skill's context, persistent transcript storage is more dangerous because the same assistant also supports sharing summaries and answering questions from meeting context, which expands secondary use of captured data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Describing generated meeting notes as convenient for archiving and sharing encourages onward distribution of content derived from potentially sensitive conversations without any mention of sanitization or access control. This is risky in a meeting tool because summaries often condense confidential decisions and action owners into a highly portable format that is easier to disclose than raw transcripts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.