ClawHub
Back to skill

Security audit

ai-meeting-notes

Security checks for vulnerabilities and agentic risk

Overview

This meeting-notes skill appears legitimate but asks users to rely on a broad, remotely configured third-party API setup that is under-scoped and under-disclosed for sensitive meeting content.

Review before installing. Only use this with meeting content you are allowed to send to SkillBoss and any downstream model providers, and prefer a scoped API key with billing limits if available. Be especially cautious about the one-command remote setup because the reviewed artifact does not contain or pin the instructions it asks your agent to fetch.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:31
Finding

Mutable External Setup Instructions Create an Instruction-Hijacking Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–38
Vulnerability Type: Unpinned remote agent instructions
Risk Level: High

Vulnerable Code:

markdown
## Setup (One Command)

Tell your agent:

set up skillboss.co/skill.md

text

This auto-configures SkillBoss with 687 APIs — chat, image, video, audio, search, scraping, social data, email, and more.

Technical Analysis

The skill instructs the agent to retrieve and act upon a remotely hosted skill.md file. The remote document is not included in the audited project, pinned to an immutable version, or protected by a documented cryptographic integrity check.

Consequently, the effective setup instructions can change after this package has been reviewed. An attacker who compromises the remote host, its deployment process, or the associated account could replace the document with instructions that alter the agent's goals or direct it to perform actions not represented by the local skill.

The local file does not itself contain an explicit safety override or malicious payload. The vulnerability arises from delegating trusted setup behavior to mutable, unaudited external instructions.

Attack Path

  1. A user or agent follows the documented setup command.
  2. The agent retrieves or interprets instructions from skillboss.co/skill.md.
  3. The remote document is modified by its operator or compromised by an attacker after the local skill has been audited.
  4. The agent treats the altered remote content as trusted operational instructions.
  5. The injected instructions may request access to files, credentials, tools, or unrelated external services.
  6. If the agent complies, actions outside the reviewed meeting-notes functionality are performed.

Impact Assessment

The exact impact depends on the permissions and tools available to the consuming agent. A successful exploit could influence the current session, cause unauthorized t ...[truncated 367 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete setup instructions within the reviewed skill package instead of directing the agent to mutable remote instructions.
  2. If remote retrieval is necessary, reference an immutable version or commit-specific URL.
  3. Publish and verify a cryptographic digest or digital signature before using downloaded content.
  4. Display retrieved instructions to the user and require explicit confirmation before executing commands or changing configuration.
  5. Restrict remote setup documents to declarative configuration rather than free-form agent instructions.
  6. Enforce an allowlist of permitted setup operations and reject instructions requesting file access, secret access, shell execution, or unrelated integrations.
  7. Document the expected content, version, and integrity value so users can independently validate the retrieved resource.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:38
Finding

Meeting-Notes Setup Advertises Excessive Unrelated API Capabilities

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 38 and lines 97–102
Vulnerability Type: Excessive capability scope and violation of least privilege
Risk Level: Medium

Vulnerable Code at line 38:

markdown
This auto-configures SkillBoss with 687 APIs — chat, image, video, audio, search, scraping, social data, email, and more.

Corroborating Code at lines 97–102:

markdown
## Why SkillBoss?

- **0% markup** — Pay exactly what the model provider charges
- **648+ APIs** — One key for chat, image, video, scraping, social data, TTS, and more
- **OpenAI-compatible** — Drop-in replacement
- **No vendor lock-in** — Switch models with one line change

Technical Analysis

The declared task is meeting transcription and summarization, which ordinarily requires only audio ingestion, transcription, and text-generation capabilities. The setup nevertheless claims to configure hundreds of APIs, including email, scraping, social-data, image, video, and other unrelated services.

This broad capability surface conflicts with the principle of least privilege. If the same credential or agent integration can access these services, compromise of that credential or manipulation of the agent may expose capabilities far beyond those needed for meeting notes.

The document also inconsistently describes the service as providing 687 APIs and 648+ APIs. This inconsistency makes the precise scope of the setup unclear. The file does not document enforceable server-side restrictions, endpoint-level scopes, or a meeting-notes-only credential profile.

Attack Path

  1. A user enables the skill solely to create meeting notes.
  2. The setup configures or exposes a shared integration covering numerous unrelated API categories.
  3. An attacker obtains the API key, compromises the remote setup instructions, or injects instructions into an agent session.
  4. The attacker directs the integration to invoke u ...[truncated 866 chars]
Remediation
View remediation

Remediation Suggestions

  1. Issue a dedicated meeting-notes credential limited to transcription, required storage operations, and text summarization.
  2. Enforce scopes on the server rather than relying only on documentation or agent behavior.
  3. Disable email, scraping, social-data, image, video, and other unrelated API families by default.
  4. Require separate, explicit user authorization for each additional capability.
  5. Support separate credentials for separate service categories to reduce the impact of credential exposure.
  6. Document exact endpoint permissions, data-access boundaries, spending limits, and revocation procedures.
  7. Add per-capability audit logs, rate limits, and billing limits.
  8. Reconcile the inconsistent API-count claims and clearly state which capabilities the setup actually enables.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill encourages use for meeting notes without warning that meeting transcripts, summaries, or related content will be transmitted to an external API provider. Because meetings often contain sensitive business, personal, legal, or regulated information, omission of this disclosure creates a serious privacy and compliance risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction 'USE THIS when the user needs ai meeting notes' is broad and may trigger the skill in loosely related contexts without adequate user awareness. In a skill that routes content to an external third-party API, over-broad invocation increases the chance that sensitive meeting data is sent off-platform unintentionally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is marketed narrowly as an AI meeting-notes tool, but its setup command provisions access to a much broader API aggregation platform. That mismatch violates least privilege and can mislead users or agents into granting capabilities far beyond transcription and summarization, increasing the blast radius if the skill is invoked or repurposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly advertises unrelated capabilities such as scraping, social data, email, image, and video APIs that are unnecessary for a meeting-notes skill. Including these capabilities in the skill context creates unnecessary privilege exposure and raises the risk of misuse, accidental data access, or user confusion about what the skill may do.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Referencing the external API endpoint in the quick test confirms that the skill depends on a third-party service and will transmit user content outside the local environment. In isolation this is normal SaaS behavior, but it becomes a vulnerability here because the skill's messaging understates the privacy implications for meeting material.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Referencing the external API endpoint in the quick test confirms that the skill depends on a third-party service and will transmit user content outside the local environment. In isolation this is normal SaaS behavior, but it becomes a vulnerability here because the skill's messaging understates the privacy implications for meeting material.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Quick Test

bash
curl -X POST "https://api.skillboss.co/v1/chat/completions" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The API reference explicitly directs agents to POST data to an external service, establishing a standing data-exfiltration channel for meeting content. This is not inherently malicious, but in a meeting-notes skill the context makes it more dangerous because users may assume local summarization rather than third-party processing of confidential discussions.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Endpoint

text
POST https://api.skillboss.co/v1/chat/completions
Authorization: Bearer $SKILLBOSS_API_KEY

Static analysis

No suspicious patterns detected.