T09 · Insecure Skill Coding Practices
Error
- Location
docker-compose.yml:49- Finding
Hardcoded Vexa, Zoom OAuth, Database, and Transcription Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
Meeting Assistant
Security checks for vulnerabilities and agentic risk
Overview
This is a real meeting assistant, but it needs Review because it ships reusable-looking credentials, exposes local services broadly, and stores highly sensitive meeting data without strong controls.
Install only after replacing all bundled tokens and secrets, binding services to localhost or an isolated Docker network, confirming participant consent, disabling or reviewing automatic chat replies for sensitive meetings, and setting retention/encryption rules for recordings, screenshots, transcripts, summaries, and Docker volumes. Avoid medical use unless your environment has appropriate privacy and compliance controls.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
docker-compose.yml:45- Finding
Vexa Management API Exposed Beyond Loopback with Published Authentication Tokens
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/meeting_monitor.py:51- Finding
Plaintext Retention of Meeting Passcodes, Medical Data, Screenshots, Transcripts, and API Tokens
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
docker-compose.yml:19- Finding
Unpinned Python Packages and Mutable Container Images Execute Unreviewed Dependency Updates
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (132)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly describes a bot that joins meetings, captures audio and chat, and performs transcription, yet provides no visible warning about participant consent, jurisdictional recording laws, or organizational privacy requirements. In a meeting-assistant context, silent or inadequately disclosed recording is especially dangerous because it can collect sensitive business, medical, or personal conversations from multiple parties at once.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation shows persistent storage of recordings, screenshots, and transcripts in a local session-data directory without any explicit warning about retention, access control, or handling of sensitive content. Because this skill is intended for live meetings, including possible doctor-patient communication, retained artifacts can expose regulated or highly confidential information if operators are unaware of storage behavior or fail to secure it properly.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full remote-meeting assistant with autonomous meeting participation, live transcription, vision analysis, chat interaction, and platform integration. The supplied code does not implement those behaviors. Instead, it is a helper module for post-hoc or in-loop prompt generation: it loads session artifacts from local storage, packages screenshots/transcripts/metadata, and creates textual prompts for another agent to perform analysis and summarization. Medical support is partially aligned at the prompt/specification level, but the core claimed capabilities—joining meetings, monitoring them as a bot, recording, live STT, direct vision analysis, and meeting chat interaction—are absent from this code chunk. This is a material description-to-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code supports part of the declared monitoring/recording workflow: it captures screenshots, records system audio, and transcribes audio using Whisper. However, the declared description centers on an active remote meeting assistant that can join meetings autonomously across Zoom/Teams/Meet, provide real-time assistance, analyze visuals via Claude, and interact with participants in meeting chat. None of those core assistant/integration features appear in this code chunk. Instead, this is a local recorder/monitor orchestrator with CLI controls and offline or near-offline transcription. The mismatch is material because several headline capabilities in the description are absent, while the implemented behavior is narrower and more passive.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The supplied code only implements offline/local audio transcription workflows using Whisper CLI and ffmpeg. It processes existing audio files, chunk directories, or recent portions of an audio file, and writes text transcripts. There is no code for connecting to Zoom/Teams/Google Meet, joining meetings as a bot, handling meeting chat, recording meetings from conferencing platforms, performing screenshot or vision analysis, or providing interactive real-time assistant behavior. While speech-to-text is part of the declared description, the implemented scope here is much narrower and materially different from the claimed end-to-end remote meeting AI assistant.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a full-featured remote meeting bot with conferencing integrations, transcription, vision analysis, and chat interaction. The supplied code does not implement any meeting-platform integration or assistant behavior. It only exposes an HTTP proxy that forwards requests to a local upstream server and rewrites the multipart 'model' field to a fixed Whisper model. While this could be a supporting component for transcription infrastructure, by itself its primary purpose is substantially narrower and materially different from the declared end-user skill description.
- Content
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Allowing the agent to send chat into a live meeting creates a direct channel for model-generated content to leave the agent context and reach third parties. In a meeting assistant handling transcripts and medical context, that raises the risk of accidental disclosure, unsafe advice, impersonation of the user, or leakage of internal reasoning into participant-visible chat.
- Content
md --- name: meeting-assistant description: "Zoom/Teams/Meet 远程会议AI助手。Use when: user asks to join a meeting, monitor a meeting, record a meeting, assist in a medical consultation, help doctor-patient communication, transcribe meeting audio, analyze meeting screenshots, send chat in meeting, or provide real-time meeting assistance. The agent joins the meeting autonomously as a bot, performs real-time speech-to-text, vision analysis via Claude AI, and participants can communicate with the agent directly via meeting chat." --- # Meeting Assistant — 远程会议智能助手
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is explicitly designed to collect, process, and retain highly sensitive meeting data, including medical consultation content, transcripts, screenshots, and chat records. Persistent storage of this material materially increases exposure to privacy breaches, insider misuse, unauthorized access, and regulatory noncompliance, especially when combined with external AI processing.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill prominently describes transcript, screenshot, chat, and summary analysis by Claude but does not clearly warn users that this meeting content is sent to an external AI provider for processing. In the context of medical consultations and private meetings, that omission creates serious privacy, consent, compliance, and third-party disclosure risk.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documented trigger logic is broad enough to respond to ordinary meeting messages, especially common punctuation, polite Chinese prompts, or generic references to AI. In a live meeting, that can cause the bot to ingest and act on unintended participant content, generate unsolicited responses, and expand collection of sensitive discussion without clear user intent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Automatic reading, summarizing, and logging of all chat, transcript, and visual meeting content creates a broad surveillance surface and captures bystander data that participants may not expect to be retained. In sensitive meetings, this can convert ephemeral conversation into long-lived records that are easier to leak, misuse, or subpoena.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documented output structure stores full transcripts, screenshots, bot suggestions, and AI-generated summaries in a persistent directory, creating a concentrated repository of sensitive meeting intelligence. If the host system, container, or shared workspace is compromised, these files would provide rich confidential information to an attacker.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 91% confidence
- Finding
Silently logging participant messages for later analysis creates an exfiltration-adjacent privacy issue because content from uninvolved or non-consenting participants is collected and may be relayed into downstream AI analysis or stored artifacts. In this skill's context, the bot joins external meetings and processes potentially medical or confidential conversations, making passive capture substantially more dangerous.
- Content
md | Starts with `请` or `请问` | `请问这个怎么处理` | AI response | | Medical keywords (medical mode) | `剂量` `处方` | AI explanation | Messages from other participants that don't match triggers are silently logged for context in the analysis loop. ## Analysis Loop
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
The documented chat-send capability enables the agent to transmit AI-generated content directly into a live meeting chat, which can leak sensitive meeting context to unintended recipients if triggered incorrectly or used in the wrong meeting. In a real-time assistant that processes transcripts and screenshots, outbound messaging materially raises disclosure risk.
- Content
print(f"Bot created: id={bot['id']}, status={bot['status']}")
text ### Send Chat Message ```python # IMPORTANT: field name is "text", NOT "message" requests.post(f"{VEXA}/bots/google_meet/pmn-eatb-cyf/chat",
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Status lifecycle:
requested → joining → awaiting_admission → active → completed | failedDELETE /bots/{platform}/{native_meeting_id} — Leave Meeting
text DELETE /bots/google_meet/pmn-eatb-cyf Response 200: {"message": "Stop request accepted and is being processed."}
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
DELETE /bots/{platform}/{native_meeting_id} — Leave Meeting
text DELETE /bots/google_meet/pmn-eatb-cyf Response 200: {"message": "Stop request accepted and is being processed."}
Context Leakage
High
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
- Content
Chat
POST /bots/{platform}/{id}/chat — Send Chat Message
json // Request — IMPORTANT: field is "text", NOT "message" {"text": "Hello from the bot!"}
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md This makes the **bot** share its screen to the meeting. It does NOT capture what the user is sharing. #### DELETE /bots/{platform}/{id}/screen — Stop Bot's Screen Share ---
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md | Method | Description | |---|---| | `join(url, bot_name=None, language=None)` | Parse URL + POST /bots | | `leave()` | DELETE /bots/{platform}/{id} | | `status()` | GET /bots/status | | `send_chat(message)` | POST /bots/{p}/{id}/chat with `{"text": message}` | | `read_chat()` | GET /bots/{p}/{id}/chat → list of messages |
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The setup guide embeds live secrets directly in documentation, including an admin API key, a current user token, and Zoom client credentials. In a meeting-assistant skill, these credentials could let an attacker control bot actions, mint tokens, access meeting integrations, or impersonate the service, making the exposure materially dangerous rather than merely informational.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This section exposes admin credentials directly in documentation and provides operational instructions for privileged
/admin/endpoints without redaction or safety guidance. Because this skill can autonomously join and monitor meetings, compromise of admin credentials could enable unauthorized control over bots, token issuance, and access to highly sensitive communications workflows.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The troubleshooting guide discloses sensitive admin and user authentication material, including an admin API key (
openclaw-meeting-bot) and a concrete user API token in diagnostic examples. In a meeting-assistant skill, these secrets are especially dangerous because they can grant access to meeting control APIs, user management, bot operations, and potentially sensitive meeting data such as transcripts or chat activity.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The diagnostic example includes a concrete API key in a request to a local meeting service endpoint, effectively publishing a bearer-style secret. In the context of a meeting assistant, possession of such a key may allow unauthorized querying of meetings, bot state, transcripts, or other sensitive collaboration data, making the exposure more dangerous than a generic sample token leak.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
python us python agent_tool.py chat "What was just prescribed?" python agent_tool.py transcript python agent_tool.py screenshot python agent_tool.py stop Usage as Python: from agent_tool import MeetingAssistantTool tool = MeetingAssistantTool() result = tool.start_assistant("https://zoom.us/j/123", mode="medical") Usage with Anthropic tool_use: from agent_tool import tool_definitions tools = tool_definitions() # pass to client.messages.create(tools=tools) """ import json import os import signal import subprocess import sys import time from datetime import datetime from pathlib import Path SKILL_DIR = Path(__file__).resolve().parent.parent CONFIG_PATH = SKILL_DIR / "config.json" STATE_FILE = SKILL_DIR / ".assistant_state.json" DAEMON_LOG = SKILL_DIR / ".assistant_daemon.log" def _load_config() -> dict: with open(CONFIG_PATH, encoding="utf-8") as f: return json.load(f) def _ok(data: dict) -> dict: return {"status": "ok", **data} def _err(message: str
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The daemon is launched with a full copy of the parent environment, which may include API keys, cloud credentials, tokens, proxy settings, and other secrets unrelated to this skill. Since the child process joins meetings, performs transcription, and may process untrusted remote content, broad environment inheritance unnecessarily expands the blast radius if the bot process or its dependencies are compromised.
- Content
python stderr=subprocess.STDOUT, start_new_session=True, cwd=str(SKILL_DIR), env={**os.environ}, ) except Exception as e: return _err(f"Failed to start assistant: {e}")
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docker-compose.yml:51
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docs/api-reference.md:6
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- docs/setup.md:121