Meeting Minutes Retriever

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:19 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a meeting-note reader and lister, but it has unrestricted URL fetching and a Windows command-injection risk that need review before installation.

Review this skill before installing. Use it only with trusted local paths and trusted meeting-document URLs, avoid Windows use until the PowerShell directory listing is replaced with Python-only enumeration or properly parameterized, and run it with network egress controls if URL fetching is allowed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/read_meeting_data.py:14

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/list_meeting_files.py:71

Finding

PowerShell Command Injection Through an Unescaped Directory Path

Content

View full analysis

list[str]: recurse_flag = " -Recurse" if recursive else "" script = ( "[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false); " "$OutputEncoding = [Console]::OutputEncoding; " f"Get-ChildItem -LiteralPath '{location}' -File{recurse_flag} | " "Select-Object -ExpandProperty FullName" ) return ["powershell", "-NoProfile", "-Command", script] ``` ### Technical Analysis The caller-controlled `location` value is interpolated directly into PowerShell source code inside a single-quoted string. PowerShell is then invoked with `-Command`, causing the generated string to be parsed as executable PowerShell syntax. Although `subprocess.run()` elsewhere uses an argument list rather than the operating-system shell, this does not prevent the vulnerability: `powershell -Command` is itself a command interpreter. A single quote contained in the directory path can terminate the intended PowerShell string. Additional PowerShell statements in the path can then be interpreted as commands. The use of `-LiteralPath` prevents wildcard expansion but does not make interpolation into PowerShell source safe. The earlier `os.path.exists()` and `os.path.isdir()` checks reduce exploitability because the supplied path must identify an existing directory. They do not eliminate the issue: Windows directory names may contain single quotes, semicolons, spaces, parentheses, and other characters that can form PowerShell syntax. An attacker able to create or select a specially named directory can satisfy the checks before reaching the vulnerable command builder. ### Attack Path 1. An attacker creates or identifies an existing Windows directory with a specially crafted name co ...[truncated 1434 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description covers three capabilities: reading meeting-note content from a local file, reading from a URL/web document, and listing files in a local meeting-notes directory. The supplied code implements only the directory-listing portion. It validates that the input is an existing local directory, enumerates files via system commands or Python, filters to .md and .txt files, and returns file count plus file list. There is no logic for opening or parsing a single meeting-notes file, no network or URL handling, and no support for remote documents like Feishu links. Therefore the description materially overstates the implemented functionality, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The implemented behavior partially matches the description: it can read from a local file or URL. However, a substantive declared capability is missing: directory inspection. The code checks whether a local path exists and is a file, and returns an error if the path is a directory. Therefore the description overstates what the skill can do. There are no obvious extra undeclared sensitive capabilities beyond file/URL reading, but the description does not accurately represent the full actual limitations, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares capabilities to read local files, fetch URLs, and invoke shell-backed directory listing behavior, but it does not declare any explicit tool scope or permissions boundary. That makes the effective access surface broader and less auditable, increasing the risk of unintended file access, outbound requests, or command execution behavior when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly supports fetching arbitrary user-supplied URLs on a best-effort basis, but it does not require a clear user-facing warning that data will be sent over the network. This can expose sensitive meeting-related queries or access patterns to external services and, depending on implementation, could enable SSRF-style access to internal or unexpected endpoints.

Content

No source excerpt is available for this finding.

Ae2

Medium

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Artifact content does not match its filename extension

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill uses OS-native command execution to perform a task that can be completed entirely with standard Python filesystem APIs. This expands the attack surface unnecessarily and, in this file, contributes directly to the Windows command-injection issue. Given the skill's purpose is only to inspect meeting-note directories, broad subprocess capability is more dangerous than needed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

This subprocess invocation executes a PowerShell command built from a user-influenced path string. Although subprocess.run is called with an argument list, the embedded PowerShell script interpolates the location into a command string, so crafted input containing quotes or PowerShell metacharacters can break out of the quoted literal and trigger command injection. In this skill, the path comes from user-supplied directory input, making the issue directly reachable.

Content

Scanner excerpt · scripts/list_meeting_files.py (reported line 51)May include surrounding context.

python

system_name = platform.system().lower()
    if system_name == "windows":
        command = _build_windows_command(location, recursive)
        output = subprocess.run(
            command,
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/list_meeting_files.py (reported line 63)May include surrounding context.

python

if system_name in {"linux", "darwin"}:
        command = _build_unix_command(location, recursive)
        output = subprocess.run(
            command,
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill can inspect a local meeting-notes directory and report the file count plus file list, but this script only supports reading a single local file or fetching a URL. For local paths, it explicitly rejects anything that is not a file, so the advertised directory-listing behavior is absent from the actual implementation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The rule explicitly prioritizes requests containing a fixed set of Chinese and English phrases, which embeds a language-specific policy in the skill behavior. The file does not state that language handling is configurable or user-selected, so this may impose a locale expectation without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.