Security audit
Security checks for vulnerabilities and agentic risk
This meeting-analysis skill is transparent about its purpose, but it enables persistent people profiling, workplace-sensitive inferences, and broad meeting-tool access without enough consent, retention, or action limits.
Install only in environments where participants are notified and authorized for transcript, recording, and profile analysis. Disable or tightly restrict cumulative profiles, promotion/resignation inferences, and meeting-admin CLI commands unless governed by policy. Do not use outputs as the sole basis for hiring, promotion, discipline, retention, or negotiation pressure decisions, and apply retention limits plus deletion workflows before using it with real meetings.
The skill explicitly supports cumulative profiling, self-profile comparison, and longitudinal tracking from speech data. This is especially sensitive because it derives persistent behavioral and identity-related inferences from conversational content, creating a robust surveillance capability even when only public meeting speech is used.
The skill indicates that profile data is retained and reused across sessions, with deletion only on request. Retention-by-default of inferred participant profiles is dangerous because it normalizes indefinite accumulation of sensitive behavioral data and makes downstream misuse, breach impact, and unauthorized surveillance substantially worse.
The exemplar explicitly instructs and demonstrates inferring sensitive psychological, relational, hierarchical, and motivational traits from meeting speech, including power orientation, trust levels, and personal drives. In a meeting-analysis skill, this is especially dangerous because it normalizes covert profiling from transcripts and could be reused for employee evaluation, manipulation, or surveillance without informed consent or reliability safeguards.
The sample output contains concrete sensitive inferences such as '核心驱动', percentages for motives, and authority/relationship judgments presented with high confidence, which can mislead users into treating speculation as objective assessment. Because the file is an exemplar, it operationalizes these outputs as desirable behavior and increases the chance the agent will produce profiling suitable for personnel ranking or adverse decisions.
This exemplar normalizes detailed behavioral profiling of a named employee, including inferred motivations, promotion readiness, and resignation risk, without any privacy, consent, fairness, or human-review safeguards. Even though the subject is marked as a pseudonym and the sample is desensitized, the skill context explicitly operationalizes sensitive workplace inference that could be used to surveil, rank, or disadvantage real individuals.
The recommendations instruct readers to monitor 'promotion' and 'resignation' signals and intervene based on those signals, but provide no warning that the output may be wrong, biased, or inappropriate as evidence for HR action. In the context of a meeting-analysis skill, this makes the content more dangerous because it turns speculative behavioral inference into an operational workflow for employment surveillance and potentially adverse action.
This is a true vulnerability because the file claims it does not endorse deception or manipulation, but then advises tactics such as disguising escalation as a break and drip-feeding key information to shape the counterpart’s behavior. In a negotiation-support skill, such tactics operationalize psychological manipulation and misleading conduct under the cover of 'strategy,' increasing misuse risk.
The finding is valid because the document’s ethics section forbids exploiting information blind spots for unfair advantage, yet earlier recommendations explicitly suggest using the counterpart’s technical weakness and selective information release to gain leverage. This creates a contradictory safety boundary that normalizes manipulative profiling-based tactics while preserving plausible deniability via an ethics disclaimer.
The file defines 12-dimensional speaker profiling, cumulative persona building, and evolution tracking across meetings without any warning that these are sensitive inferences about individuals. This is dangerous because inferred behavioral or personality profiles can be inaccurate, discriminatory, or repurposed for surveillance and employment decisions, especially when accumulated over time and tied to named speakers.
The document exposes live intervention commands including calling users into a meeting and kicking participants out, which are not justified by the stated purpose of deep meeting processing. In an agentic context, documenting these commands inside the skill increases the chance of disruptive, unauthorized real-time actions against meeting participants, especially because the skill is framed as analysis-oriented rather than moderation/admin tooling.
The trigger list contains broad, common meeting-related phrases that could cause the skill to activate in routine contexts where users did not intend deep profiling or external data access. That increases the chance of over-collection, unexpected invocation, and accidental processing of sensitive meeting content.
The skill describes persistent collection and reuse of participant profiling data across meetings, including comparisons and historical optimization. Cross-session behavioral profiling materially increases privacy risk because it enables longitudinal surveillance and secondary use of sensitive inferences beyond the original meeting context.
The skill is not limited to passive processing; it includes direct meeting participation, real-time monitoring, and intervention behavior. In security and privacy terms, this increases risk because the skill can influence live conversations and process sensitive content in-flight, not just analyze user-supplied records afterward.
Extracting structured personal profiles from meeting content into organizational knowledge assets turns transient speech into durable personal data records. That raises the risk of misuse, over-sharing, unauthorized access, and repurposing of inferred traits in ways participants may not expect or consent to.
The skill claims to be platform-agnostic, but its documented fallback uses a specific CLI to directly retrieve meeting data. That creates a hidden capability expansion: a user may invoke what appears to be passive analysis, while the skill actually reaches out to acquire sensitive meeting artifacts from an external/local data source.
The description does not clearly warn users that the skill may fetch meeting data through external skills or a CLI fallback. This weakens informed consent and can lead users to expose sensitive recordings, transcripts, or metadata without realizing the skill will actively obtain them.
Requesting the user's own 12-dimensional profile as an input parameter expands the amount of sensitive personal data handled by the skill. If combined with meeting-derived participant profiles, this can enable sensitive matching, inference amplification, or unintended exposure of intimate attributes and behavioral models.
This markdown file presents all instructions, labels, and user guidance only in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or clear region-specific justification is a locale policy concern.
This markdown exemplar is written as a prescriptive template and style guide in Chinese, including required phrasing and fixed output structure, but it does not indicate that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
The template explicitly includes collection and reporting of nonverbal behaviors such as nodding, facial reactions, phone checking, and note-taking, but provides no privacy notice, consent requirement, minimization guidance, or caution about how sensitive these observations can be. In a meeting-analysis skill, normalizing this level of behavioral surveillance can enable covert profiling of workers and create privacy, labor, and compliance risks if used without participant awareness.
The sample report draws sensitive inferences about mental state, confidence, motivation, hierarchy effects, and comprehension from sparse behavioral cues, such as labeling a participant as 'completely passive,' 'not confident,' 'nervous/confused,' or 'following but choosing silence.' Presenting these inferences as actionable analysis without caution, uncertainty language, or bias controls can lead to unfair personnel judgments, discriminatory treatment, and misuse in workplace evaluation contexts.
The template explicitly recommends permanent retention of a meeting recording and broad access for the full technical team, but it does not mention consent, legal basis, retention minimization, privacy review, or handling of personal/sensitive content. In a meeting-processing skill, this is dangerous because users may operationalize the template as policy guidance, leading to unnecessary long-term storage and over-broad internal disclosure of recorded communications.
The exemplar explicitly endorses augmenting meeting analysis with post-meeting informal conversations and testing-system records, which broadens the skill from transcript-based analysis into employee surveillance and off-channel performance monitoring. This is dangerous because downstream implementations may normalize collecting and correlating extra-contextual personnel data without clear consent, minimization, or scope limits, increasing privacy, labor-sensitivity, and misuse risks.
This markdown exemplar forces a specific language/locale in its natural-language instructions and sample content. Under the policy rule, language-specific content should either offer user opt-in or clearly document a justified region- or locale-specific constraint, which is not present here.
The file is entirely written as a Chinese-only operational template and includes direct meeting scripts for the host to read, but it does not offer any user language choice or explain that the skill is limited to Chinese-language contexts. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
