meeting-notes-to-action

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent offline meeting-notes extractor that reads user-provided notes and writes user-requested summaries, with no evidence of hidden network, persistence, or destructive behavior.

Before installing, consider that meeting notes can contain sensitive internal information. Use explicit output paths, review generated minutes and email drafts before sharing, and avoid feeding transcripts that include secrets or confidential details unless local storage is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation advertises execution of a Python script that reads input notes and writes JSON/Markdown/email outputs, and the static analyzer also detected shell capability, but the manifest declares no explicit tool scope or permission boundaries. That creates an authorization gap: an agent may invoke file and shell operations without user-visible constraints, increasing the chance of overbroad filesystem access or unexpected command execution in environments that honor skill metadata for sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code writes extracted meeting decisions, action items, and an email draft to user-specified files, which may contain sensitive internal discussion content. Although the script's module docstring states it outputs JSON, Markdown minutes, and an email draft, there is no user-facing warning at the write points about persisting potentially sensitive meeting data to disk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_meeting_extractor.py (reported line 45)May include surrounding context.

python

with tempfile.NamedTemporaryFile("w", suffix=".txt", delete=False) as f:
        f.write(text)
        p = Path(f.name)
    r = subprocess.run([sys.executable, str(SCRIPT), str(p),
                        "--meeting-date", "2026-08-12"] + list(extra),
                       capture_output=True, text=True)
    p.unlink()

Static analysis

No suspicious patterns detected.