ClawHub
Back to skill

Security audit

meeting-notes-to-action

Security checks across malware telemetry and agentic risk

Overview

This skill is a local meeting-notes parser that reads user-chosen files and writes user-chosen summaries without hidden network, persistence, or credential behavior.

Use this on meeting notes you are comfortable processing locally and writing to the selected output files. Review low-confidence items and the generated email before distributing it, especially because meeting notes can contain sensitive business or personnel information.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation instructs users to run a local Python script that reads meeting notes, writes JSON/Markdown/email outputs, and accepts prior JSON files, which clearly implies file_read, file_write, and shell execution capabilities. Because these capabilities are present but no permissions are declared, the skill creates a transparency and policy gap: operators may invoke it with broader access than expected, increasing the chance of unintended exposure or modification of sensitive meeting data.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.