Meeting Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:17 AM UTC
• Version: 1.0.0

Overview

This is a real meeting assistant, but it needs Review because it ships reusable-looking credentials, exposes local services broadly, and stores highly sensitive meeting data without strong controls.

Install only after replacing all bundled tokens and secrets, binding services to localhost or an isolated Docker network, confirming participant consent, disabling or reviewing automatic chat replies for sensitive meetings, and setting retention/encryption rules for recordings, screenshots, transcripts, summaries, and Docker volumes. Avoid medical use unless your environment has appropriate privacy and compliance controls.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: docker-compose.yml:49
• Finding: Hardcoded Vexa, Zoom OAuth, Database, and Transcription Credentials<![CDATA[ ## Vulnerability Details **File Location**: `config.json:42-45`, `docker-compose.yml:5-8`, `docker-compose.yml:49-58`, `docs/setup.md:44-62`, `docs/setup.md:147-150`, `docs/agent-usage.md:191-192`, `docs/troubleshooting.md:174-184` **Vulnerability Type**: Hardcoded reusable credentials **Risk Level**: Critical ### Vulnerable Code `config.json:42-45`: ```json "bot": { "vexa_url": "http://localhost:8056", "vexa_api_key": "dGosC39FSoaw0UpIVdhroaz42heFR0ou4bC5yiIc", "bot_name": "OpenClaw 助手", ``` `docker-compose.yml:5-8`: ```yaml environment: - POSTGRES_USER=vexa - POSTGRES_PASSWORD=vexa_pass - POSTGRES_DB=vexa ``` `docker-compose.yml:49-58`: ```yaml environment: - DATABASE_URL=postgresql://vexa:vexa_pass@postgres:5432/vexa - ADMIN_API_TOKEN=openclaw-meeting-bot - TRANSCRIPTION_ENABLED=true - TRANSCRIBER_URL=http://whisper-proxy:8000/v1/audio/transcriptions - REMOTE_TRANSCRIBER_URL=http://whisper-proxy:8000/v1/audio/transcriptions - TRANSCRIBER_API_KEY=openclaw-key - REMOTE_TRANSCRIBER_API_KEY=openclaw-key - ZOOM_CLIENT_ID=YZXafYz5STiVV3qbh2Sh0w - ZOOM_CLIENT_SECRET=IlvPhToAqWorTeW3qLLNUTnF9I1ItxUs ``` The Vexa user token and static administrative token are also reproduced in documentation and diagnostic commands. ### Technical Analysis The project commits several reusable secrets directly to source-controlled configuration and documentation: - A Vexa user API token - A Vexa administrative API token - A Zoom OAuth client ID and client secret - PostgreSQL credentials - Transcription API keys Hardcoded secrets cannot be independently controlled per installation and are exposed to every person or system that receives a copy of the project. Removing them from the current files is insufficient if they remain in repository history, build artifacts, logs, or documentation caches. The administrative and user tokens have different privilege scopes, but both are published. The administrative token may permit management of V ...[truncated 1611 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately revoke and rotate the exposed Vexa user token, administrative token, Zoom client secret, database password, and transcription keys. 2. Remove all literal credentials from configuration, examples, troubleshooting commands, and repository history. 3. Load secrets from environment variables, Docker secrets, or an operating-system secret manager. For example: ```yaml environment: DATABASE_URL: ${DATABASE_URL:?DATABASE_URL is required} ADMIN_API_TOKEN: ${VEXA_ADMIN_API_TOKEN:?VEXA_ADMIN_API_TOKEN is required} ZOOM_CLIENT_ID: ${ZOOM_CLIENT_ID:?ZOOM_CLIENT_ID is required} ZOOM_CLIENT_SECRET: ${ZOOM_CLIENT_SECRET:?ZOOM_CLIENT_SECRET is required} ``` 4. Supply a sanitized `.env.example` containing placeholders only, and exclude real `.env` files from version control. 5. Generate unique, high-entropy credentials for every deployment rather than shipping universal defaults. 6. Restrict administrative credentials to administrative workflows; never reuse them for normal bot API calls. 7. Add automated secret scanning to CI and pre-commit checks. 8. Review Vexa and Zoom access logs for use of the exposed values and invalidate any tokens created through unauthorized administrative access. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: docker-compose.yml:45
• Finding: Vexa Management API Exposed Beyond Loopback with Published Authentication Tokens<![CDATA[ ## Vulnerability Details **File Location**: `docker-compose.yml:45-51`, `config.json:42-45`, `scripts/meeting_bot.py:43-56` **Vulnerability Type**: Excessive network exposure and weak access-control deployment **Risk Level**: High ### Vulnerable Code `docker-compose.yml:45-51`: ```yaml vexa: image: vexaai/vexa-lite:latest container_name: vexa-meeting-bot ports: - "8056:8056" environment: - DATABASE_URL=postgresql://vexa:vexa_pass@postgres:5432/vexa - ADMIN_API_TOKEN=openclaw-meeting-bot ``` `config.json:42-45`: ```json "bot": { "vexa_url": "http://localhost:8056", "vexa_api_key": "dGosC39FSoaw0UpIVdhroaz42heFR0ou4bC5yiIc", "bot_name": "OpenClaw 助手", ``` `scripts/meeting_bot.py:43-56`: ```python self.base_url = bot_cfg.get("vexa_url", "http://localhost:8056").rstrip("/") self.api_key = bot_cfg.get("vexa_api_key", "openclaw-meeting-bot") self.bot_name = bot_cfg.get("bot_name", "OpenClaw 助手") self.bot_id = None self.platform = None self.meeting_id = None self._polling_thread = None self._polling = False @property def headers(self): h = {"Content-Type": "application/json"} if self.api_key: h["X-API-Key"] = self.api_key return h ``` ### Technical Analysis Docker short-form port publication (`"8056:8056"`) normally binds the service to all host interfaces, not only to loopback. This conflicts with the application configuration and documentation, which treat Vexa as a localhost-only service. The exposure becomes materially exploitable because both the normal Vexa user token and the administrative token are committed in the project. Authentication therefore does not provide a meaningful boundary to anyone who can obtain the package. The Skill legitimately needs local access to Vexa, but it does not need to make the management API reachable from other hosts. Publishing it on all interfaces exceeds the minimum network privilege required for the declared meeting-assistant functionality. The Whisper proxy ...[truncated 1526 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind host-facing services explicitly to loopback: ```yaml ports: - "127.0.0.1:8056:8056" ``` 2. If host publication is unnecessary, remove `ports` and keep communication on an isolated Docker network. 3. Replace all published tokens with unique generated secrets and rotate them immediately. 4. Add host firewall rules denying access to Vexa from non-loopback interfaces. 5. Separate administrative endpoints from user endpoints and do not expose administrative APIs on the same listener when avoidable. 6. Add rate limiting, authentication failure logging, token expiration, and token revocation support. 7. Use TLS and a properly authenticated reverse proxy if remote access is genuinely required. 8. Bind the Whisper proxy to its intended internal interface, correct the port mismatch, restrict forwarding to required transcription paths, and require service-to-service authentication. 9. Add an automated deployment test that verifies ports 8000 and 8056 are not reachable from another host. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/meeting_monitor.py:51
• Finding: Plaintext Retention of Meeting Passcodes, Medical Data, Screenshots, Transcripts, and API Tokens<![CDATA[ ## Vulnerability Details **File Location**: `scripts/meeting_bot.py:448-456`, `scripts/meeting_bot.py:503-508`, `scripts/meeting_monitor.py:51-62`, `scripts/meeting_monitor.py:426-433` **Vulnerability Type**: Unencrypted sensitive-data storage and excessive data retention **Risk Level**: High ### Vulnerable Code `scripts/meeting_bot.py:448-456`: ```python meta = { "start_time": datetime.now().isoformat(), "meeting_url": meeting_url, "mode": mode, "bot_id": self.bot.bot_id, "platform": self.bot.platform, "claude_enabled": self.claude is not None, } with open(self.session_dir / "session.json", "w") as f: json.dump(meta, f, indent=2, ensure_ascii=False) ``` `scripts/meeting_bot.py:503-508`: ```python if self.session_dir: with open(self.session_dir / "transcript_log.json", "w", encoding="utf-8") as f: json.dump(self.transcript_log, f, ensure_ascii=False, indent=2) with open(self.session_dir / "suggestions_log.json", "w", encoding="utf-8") as f: json.dump(self.suggestions_log, f, ensure_ascii=False, indent=2) ``` `scripts/meeting_monitor.py:51-62`: ```python def save_session_meta(session_dir, config, mode, extra=None): meta = { "start_time": datetime.now().isoformat(), "mode": mode, "config": config, "status": "recording", } if extra: meta.update(extra) with open(session_dir / "session.json", "w") as f: json.dump(meta, f, indent=2, ensure_ascii=False) return meta ``` `scripts/meeting_monitor.py:426-433`: ```python with open(PID_FILE, "w") as f: json.dump({ "pid": os.getpid(), "session_dir": str(self.session_dir), "start_time": datetime.now().isoformat() }, f) ``` ### Technical Analysis Bot-mode metadata stores the complete meeting URL. Zoom meeting URLs commonly contain a `pwd` query parameter, so the persisted URL may function as a reusable meeting credential. The local monitor stores the entire ...[truncated 2340 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never serialize the complete configuration. Store an explicit allowlist of non-secret metadata: ```python meta = { "start_time": datetime.now().isoformat(), "mode": mode, "status": "recording", "whisper_model": config.get("whisper_model"), "whisper_language": config.get("whisper_language"), } ``` 2. Redact meeting URLs before persistence. Remove query strings, fragments, passcodes, and embedded tokens. 3. Encrypt recordings, transcripts, screenshots, and summaries at rest using a key kept outside the session directory. 4. Create directories and files with owner-only permissions and verify permissions after creation. 5. Capture only the meeting window rather than the entire primary desktop. 6. Make audio recording, screenshot collection, transcript retention, and cloud analysis separate opt-in options. 7. Present explicit consent and privacy notices to all participants before capture begins. 8. Define a short, configurable retention period and automatically delete expired session data. 9. Avoid relying on ordinary file deletion for highly sensitive data; use encrypted storage and destroy the encryption key at expiration. 10. Exclude `recordings/`, daemon logs, state files, and generated summaries from version control and cloud synchronization by default. 11. Provide a command that securely removes a selected session and reports every deleted artifact. ]]>

T08 · Insecure Dependencies

Warning

• Location: docker-compose.yml:19
• Finding: Unpinned Python Packages and Mutable Container Images Execute Unreviewed Dependency Updates<![CDATA[ ## Vulnerability Details **File Location**: `docker-compose.yml:3`, `docker-compose.yml:19`, `docker-compose.yml:45`, `requirements.txt:1`, `SKILL.md:53-56` **Vulnerability Type**: Mutable and unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code `docker-compose.yml:3`: ```yaml image: postgres:16-alpine ``` `docker-compose.yml:19`: ```yaml image: fedirz/faster-whisper-server:latest-cpu ``` `docker-compose.yml:45`: ```yaml image: vexaai/vexa-lite:latest ``` `requirements.txt:1`: ```text openai-whisper ``` `SKILL.md:53-56`: ```bash export ANTHROPIC_API_KEY="sk-ant-..." # 3. Install Python dependencies pip install anthropic requests ``` ### Technical Analysis The `latest` and `latest-cpu` image tags are mutable. The image content executed by a future `docker compose up` or image pull can therefore differ from the content that was originally reviewed. `postgres:16-alpine` is narrower but remains mutable within the selected tag. The Python dependency file also omits an exact version and integrity hash, while the installation documentation instructs users to install additional packages without version constraints. Dependency resolution can consequently select new and unreviewed code at installation time. No evidence was found that the named packages are currently malicious or typosquatted. The vulnerability is the absence of reproducible dependency selection and integrity verification, which increases exposure to upstream compromise and unsafe updates. ### Attack Path 1. A registry image tag or package release changes after the Skill has been reviewed. 2. The change may result from a legitimate incompatible update, compromised maintainer account, registry compromise, or malicious upstream release. 3. A user follows the installation instructions or restarts the stack after pulling newer images. 4. Docker or `pip` downloads the changed dependency without checking an audited digest or hash. 5. The new dependency code exe ...[truncated 1063 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin container images to reviewed immutable digests: ```yaml image: fedirz/faster-whisper-server@sha256:REVIEWED_DIGEST image: vexaai/vexa-lite@sha256:REVIEWED_DIGEST image: postgres@sha256:REVIEWED_DIGEST ``` 2. Pin exact Python package versions in a lockfile. 3. Generate and verify package hashes, for example through `pip-compile --generate-hashes`. 4. Include all runtime packages in the dependency manifest rather than installing undocumented floating versions. 5. Use a controlled internal package or image mirror where appropriate. 6. Scan packages and images for known vulnerabilities before release and on a scheduled basis. 7. Review release notes and security advisories before updating a digest or lockfile. 8. Run containers as non-root users where supported, use read-only filesystems, drop unnecessary Linux capabilities, and restrict outbound network access. 9. Configure automated dependency updates to create reviewable changes rather than automatically deploying mutable tags. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (132)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The README explicitly describes a bot that joins meetings, captures audio and chat, and performs transcription, yet provides no visible warning about participant consent, jurisdictional recording laws, or organizational privacy requirements. In a meeting-assistant context, silent or inadequately disclosed recording is especially dangerous because it can collect sensitive business, medical, or personal conversations from multiple parties at once.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The documentation shows persistent storage of recordings, screenshots, and transcripts in a local session-data directory without any explicit warning about retention, access control, or handling of sensitive content. Because this skill is intended for live meetings, including possible doctor-patient communication, retained artifacts can expose regulated or highly confidential information if operators are unaware of storage behavior or fail to secure it properly.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a full remote-meeting assistant with autonomous meeting participation, live transcription, vision analysis, chat interaction, and platform integration. The supplied code does not implement those behaviors. Instead, it is a helper module for post-hoc or in-loop prompt generation: it loads session artifacts from local storage, packages screenshots/transcripts/metadata, and creates textual prompts for another agent to perform analysis and summarization. Medical support is partially aligned at the prompt/specification level, but the core claimed capabilities—joining meetings, monitoring them as a bot, recording, live STT, direct vision analysis, and meeting chat interaction—are absent from this code chunk. This is a material description-to-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code supports part of the declared monitoring/recording workflow: it captures screenshots, records system audio, and transcribes audio using Whisper. However, the declared description centers on an active remote meeting assistant that can join meetings autonomously across Zoom/Teams/Meet, provide real-time assistance, analyze visuals via Claude, and interact with participants in meeting chat. None of those core assistant/integration features appear in this code chunk. Instead, this is a local recorder/monitor orchestrator with CLI controls and offline or near-offline transcription. The mismatch is material because several headline capabilities in the description are absent, while the implemented behavior is narrower and more passive.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The supplied code only implements offline/local audio transcription workflows using Whisper CLI and ffmpeg. It processes existing audio files, chunk directories, or recent portions of an audio file, and writes text transcripts. There is no code for connecting to Zoom/Teams/Google Meet, joining meetings as a bot, handling meeting chat, recording meetings from conferencing platforms, performing screenshot or vision analysis, or providing interactive real-time assistant behavior. While speech-to-text is part of the declared description, the implemented scope here is much narrower and materially different from the claimed end-to-end remote meeting AI assistant.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full-featured remote meeting bot with conferencing integrations, transcription, vision analysis, and chat interaction. The supplied code does not implement any meeting-platform integration or assistant behavior. It only exposes an HTTP proxy that forwards requests to a local upstream server and rewrites the multipart 'model' field to a fixed Whisper model. While this could be a supporting component for transcription infrastructure, by itself its primary purpose is substantially narrower and materially different from the declared end-user skill description.

Context Leakage

High

• Category: Data Exfiltration

Content

---
name: meeting-assistant
description: "Zoom/Teams/Meet 远程会议AI助手。Use when: user asks to join a meeting, monitor a meeting, record a meeting, assist in a medical consultation, help doctor-patient communication, transcribe meeting audio, analyze meeting screenshots, send chat in meeting, or provide real-time meeting assistance. The agent joins the meeting autonomously as a bot, performs real-time speech-to-text, vision analysis via Claude AI, and participants can communicate with the agent directly via meeting chat."
---

# Meeting Assistant — 远程会议智能助手

• Confidence: 85% confidence
• Finding: Allowing the agent to send chat into a live meeting creates a direct channel for model-generated content to leave the agent context and reach third parties. In a meeting assistant handling transcripts and medical context, that raises the risk of accidental disclosure, unsafe advice, impersonation of the user, or leakage of internal reasoning into participant-visible chat.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill is explicitly designed to collect, process, and retain highly sensitive meeting data, including medical consultation content, transcripts, screenshots, and chat records. Persistent storage of this material materially increases exposure to privacy breaches, insider misuse, unauthorized access, and regulatory noncompliance, especially when combined with external AI processing.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill prominently describes transcript, screenshot, chat, and summary analysis by Claude but does not clearly warn users that this meeting content is sent to an external AI provider for processing. In the context of medical consultations and private meetings, that omission creates serious privacy, consent, compliance, and third-party disclosure risk.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The documented trigger logic is broad enough to respond to ordinary meeting messages, especially common punctuation, polite Chinese prompts, or generic references to AI. In a live meeting, that can cause the bot to ingest and act on unintended participant content, generate unsolicited responses, and expand collection of sensitive discussion without clear user intent.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Automatic reading, summarizing, and logging of all chat, transcript, and visual meeting content creates a broad surveillance surface and captures bystander data that participants may not expect to be retained. In sensitive meetings, this can convert ephemeral conversation into long-lived records that are easier to leak, misuse, or subpoena.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The documented output structure stores full transcripts, screenshots, bot suggestions, and AI-generated summaries in a persistent directory, creating a concentrated repository of sensitive meeting intelligence. If the host system, container, or shared workspace is compromised, these files would provide rich confidential information to an attacker.

Exfiltration Commands

High

• Category: Prompt Injection

Content

| Starts with `请` or `请问` | `请问这个怎么处理` | AI response |
| Medical keywords (medical mode) | `剂量` `处方` | AI explanation |

Messages from other participants that don't match triggers are silently logged
for context in the analysis loop.

## Analysis Loop

• Confidence: 91% confidence
• Finding: Silently logging participant messages for later analysis creates an exfiltration-adjacent privacy issue because content from uninvolved or non-consenting participants is collected and may be relayed into downstream AI analysis or stored artifacts. In this skill's context, the bot joins external meetings and processes potentially medical or confidential conversations, making passive capture substantially more dangerous.

Context Leakage

High

• Category: Data Exfiltration

Content

print(f"Bot created: id={bot['id']}, status={bot['status']}")
```

### Send Chat Message
```python
# IMPORTANT: field name is "text", NOT "message"
requests.post(f"{VEXA}/bots/google_meet/pmn-eatb-cyf/chat",

• Confidence: 85% confidence
• Finding: The documented chat-send capability enables the agent to transmit AI-generated content directly into a live meeting chat, which can leak sensitive meeting context to unintended recipients if triggered incorrectly or used in the wrong meeting. In a real-time assistant that processes transcripts and screenshots, outbound messaging materially raises disclosure risk.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

Status lifecycle: `requested → joining → awaiting_admission → active → completed | failed`

#### DELETE /bots/{platform}/{native_meeting_id} — Leave Meeting
```
DELETE /bots/google_meet/pmn-eatb-cyf
Response 200: {"message": "Stop request accepted and is being processed."}

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#### DELETE /bots/{platform}/{native_meeting_id} — Leave Meeting
```
DELETE /bots/google_meet/pmn-eatb-cyf
Response 200: {"message": "Stop request accepted and is being processed."}
```

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Context Leakage

High

• Category: Data Exfiltration

Content

### Chat

#### POST /bots/{platform}/{id}/chat — Send Chat Message
```json
// Request — IMPORTANT: field is "text", NOT "message"
{"text": "Hello from the bot!"}

• Confidence: 85% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

This makes the **bot** share its screen to the meeting. It does NOT capture
what the user is sharing.

#### DELETE /bots/{platform}/{id}/screen — Stop Bot's Screen Share

---

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Method | Description |
|---|---|
| `join(url, bot_name=None, language=None)` | Parse URL + POST /bots |
| `leave()` | DELETE /bots/{platform}/{id} |
| `status()` | GET /bots/status |
| `send_chat(message)` | POST /bots/{p}/{id}/chat with `{"text": message}` |
| `read_chat()` | GET /bots/{p}/{id}/chat → list of messages |

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The setup guide embeds live secrets directly in documentation, including an admin API key, a current user token, and Zoom client credentials. In a meeting-assistant skill, these credentials could let an attacker control bot actions, mint tokens, access meeting integrations, or impersonate the service, making the exposure materially dangerous rather than merely informational.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: This section exposes admin credentials directly in documentation and provides operational instructions for privileged `/admin/` endpoints without redaction or safety guidance. Because this skill can autonomously join and monitor meetings, compromise of admin credentials could enable unauthorized control over bots, token issuance, and access to highly sensitive communications workflows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The troubleshooting guide discloses sensitive admin and user authentication material, including an admin API key (`openclaw-meeting-bot`) and a concrete user API token in diagnostic examples. In a meeting-assistant skill, these secrets are especially dangerous because they can grant access to meeting control APIs, user management, bot operations, and potentially sensitive meeting data such as transcripts or chat activity.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The diagnostic example includes a concrete API key in a request to a local meeting service endpoint, effectively publishing a bearer-style secret. In the context of a meeting assistant, possession of such a key may allow unauthorized querying of meetings, bot state, transcripts, or other sensitive collaboration data, making the exposure more dangerous than a generic sample token leak.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

us
  python agent_tool.py chat "What was just prescribed?"
  python agent_tool.py transcript
  python agent_tool.py screenshot
  python agent_tool.py stop

Usage as Python:
  from agent_tool import MeetingAssistantTool
  tool = MeetingAssistantTool()
  result = tool.start_assistant("https://zoom.us/j/123", mode="medical")

Usage with Anthropic tool_use:
  from agent_tool import tool_definitions
  tools = tool_definitions()  # pass to client.messages.create(tools=tools)
"""

import json
import os
import signal
import subprocess
import sys
import time
from datetime import datetime
from pathlib import Path

SKILL_DIR = Path(__file__).resolve().parent.parent
CONFIG_PATH = SKILL_DIR / "config.json"
STATE_FILE = SKILL_DIR / ".assistant_state.json"
DAEMON_LOG = SKILL_DIR / ".assistant_daemon.log"


def _load_config() -> dict:
    with open(CONFIG_PATH, encoding="utf-8") as f:
        return json.load(f)


def _ok(data: dict) -> dict:
    return {"status": "ok", **data}


def _err(message: str

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

stderr=subprocess.STDOUT,
                start_new_session=True,
                cwd=str(SKILL_DIR),
                env={**os.environ},
            )
        except Exception as e:
            return _err(f"Failed to start assistant: {e}")

• Confidence: 96% confidence
• Finding: The daemon is launched with a full copy of the parent environment, which may include API keys, cloud credentials, tokens, proxy settings, and other secrets unrelated to this skill. Since the child process joins meetings, performs transcription, and may process untrusted remote content, broad environment inheritance unnecessarily expands the blast radius if the bot process or its dependencies are compromised.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docker-compose.yml:51

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docs/api-reference.md:6

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: docs/setup.md:121