Security audit

Meeting Notes Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is not malware, but it is sent to Review because it advertises real AI meeting processing, cloud use, storage, and sharing while the bundled tool only prints canned sample notes.

Review carefully before installing. It appears locally contained and non-destructive, but it should be treated as a demo/template generator rather than a real AI meeting-notes product. Do not rely on its output as meeting-derived notes, and do not assume the advertised cloud, storage, sharing, or task-tracking features exist or are safely scoped.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises an AI meeting assistant that turns meeting recordings or text into professional minutes via automatic transcription, summarization, action-item extraction, and task assignment. The code instead is a formatting/template utility with hardcoded SAMPLE_DATA and print-based commands. It accepts CLI commands like generate/template/actions/export, but generate only renders predefined sample structures for meeting types. There is no audio handling, speech-to-text, NLP/LLM integration, parsing of meeting text, or logic to infer summaries/action items from input. While the general domain of meeting notes is related, the core claimed capabilities are materially absent, so the declared description does not accurately represent the code's actual behavior.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The described export, email, and attendee-sharing features imply redistribution of potentially sensitive meeting notes, but the skill text provides no warning about where data is sent or who may receive it. This creates a realistic risk of accidental disclosure of internal, personal, or client information through integrations and bulk sharing features.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill states that meeting content may be processed using 'Local + Cloud AI' but does not warn users that sensitive meeting transcripts, recordings, or attendee information could be sent to third-party cloud services. In a meeting-notes context, this can expose confidential business discussions, personnel information, or client data without informed consent.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill metadata promises automatic transcription, summarization, task extraction, and assignment, but the implementation only emits hard-coded sample content and templates. This is dangerous because users may rely on fabricated or placeholder meeting notes as if they were derived from real meetings, leading to misinformation, missed tasks, privacy/compliance misunderstandings, and unsafe business decisions based on false output.

Natural-Language Policy Violations

Low

Confidence: 86% confidence
Finding: The technical details specify supported languages with "auto-detect" only, which implies the skill determines language automatically rather than allowing the user to choose or confirm a locale. This can conflict with language/locale policy expectations when user preference or consent is required.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: This Python file includes a user-visible natural-language description in Chinese alongside the English title. Under the policy, forcing or assuming a specific language without opt-in can be a locale/language policy issue, and the file provides no mechanism or note indicating language choice.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: The help text advertises action-item commands such as 'add' and 'complete', but the code only supports 'list' and 'overdue'. While this is not direct code execution risk, it is an integrity and trust issue: users may believe action items are being recorded or completed when no such state-changing behavior exists, causing silent operational failure.

Static analysis

No suspicious patterns detected.