ClawHub
Back to skill

Security audit

meeting-transcript-to-summary

Security checks for vulnerabilities and agentic risk

Overview

This is a passive meeting-transcript summarization skill with sloppy template documentation but no artifact-backed hidden execution, persistence, exfiltration, or destructive behavior.

Installers should treat this as a simple transcript summarization prompt, not as a tool that should receive file-write authority or API credentials. Do not provide an API key or run the README's write-mode example unless the publisher supplies a concrete implementation and explains what data is sent or modified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear mismatch between the declared purpose and the actual code behavior. The description claims a meeting-transcript summarization skill, but the code exclusively implements automated tests for skill packaging and documentation quality. Its primary purpose is QA/validation of skill repository contents, not processing user transcripts. No transcript parsing, summarization, action-item extraction, or owner identification appears in the code. This is a materially different primary purpose with several undeclared capabilities related to filesystem inspection and secret scanning.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
- Do not make up facts or claim actions were taken that were not
- Do not hardcode API keys — use `os.getenv("API_KEY")` instead
- Do not store sensitive user data beyond the current session
- Do not exceed token budget without warning the user first
- Do not activate for off-topic requests — return a brief decline message

### Do

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README says "When triggered: [trigger condition]", which is an unresolved placeholder rather than a concrete activation condition. This makes it unclear when the skill should activate and provides no specific trigger scope or exclusions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The README advertises a --mode write operation without any warning about file-modifying behavior, output paths, or overwrite risks. In an agentic setting, unclear write semantics can lead users or automation to run the skill with elevated trust, causing unintended file creation or modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The line '触发条件：[trigger condition]。' is an unresolved placeholder rather than a concrete trigger or invocation rule. This makes activation conditions ambiguous and fails to specify when the skill should or should not be used, which can lead to unintended invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README describes generic 'read' and 'write' execution modes that do not align with a skill whose stated purpose is summarizing pasted meeting transcripts. This mismatch can mislead operators into granting broader file or data access than necessary, increasing the risk of unintended data handling or misuse even if no exploit code is present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Documenting a write mode without warning about data modification is risky because users may invoke it expecting passive summarization, not state changes. In the context of a transcript summarization skill, undocumented write behavior is more suspicious because modification capabilities are unnecessary to the core task and could lead to accidental overwrites or unauthorized changes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
- Do not make up facts or claim actions were taken that were not
- Do not hardcode API keys — use `os.getenv("API_KEY")` instead
- Do not store sensitive user data beyond the current session
- Do not exceed token budget without warning the user first
- Do not activate for off-topic requests — return a brief decline message

### Do

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code requires the presence of README_zh.md, which imposes a specific locale expectation in the skill quality checks. The file does not indicate that language choice is optional or that the Chinese locale requirement is justified by a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file includes a natural-language policy that requires contributors to keep the SKILL.md body in English. A mandatory language restriction is a locale/language policy constraint, and the file does not present it as optional or justify it as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file explicitly states that the SKILL.md body and reference docs must be in English. This is a natural-language policy violation under the language/locale rule because it imposes a specific language without opt-in or an explained necessity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Requiring an API key is inconsistent with a skill advertised as operating on user-pasted transcripts, suggesting undisclosed external service usage or unnecessary credential collection. While not proof of malicious behavior, this can expose secrets, expand the trust boundary, and create privacy concerns for meeting content sent to third-party services.

Content

No source excerpt is available for this finding.