← Back to Skills Marketplace
217
Downloads
0
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install meeting-minutes-retriever
Description
Read meeting minutes or notes from a local file path or URL, or inspect a local meeting-notes directory and report the file count plus file list. Use when th...
Usage Guidance
This skill appears to do what it says: read meeting files or list meeting-note files. Before installing, consider the following: (1) The skill will read any local file path you provide and will fetch any URL you provide — only give it paths/links you trust. (2) The directory lister uses OS commands via subprocess; on Windows the PowerShell command embeds the path without escaping single quotes which could be fragile or potentially abused if untrusted paths are supplied. (3) Run the skill in a restricted/sandboxed environment if possible (limited filesystem access, limited network egress) and review the scripts if you need higher assurance. If you want a safer fix, replace shell-based listing with purely Python directory enumeration or ensure the path is properly escaped/validated before calling PowerShell.
Capability Analysis
Type: OpenClaw Skill
Name: meeting-minutes-retriever
Version: 1.0.0
The skill contains a critical command injection vulnerability in 'scripts/list_meeting_files.py' where the 'location' parameter is unsafely interpolated into a PowerShell command string. Additionally, 'scripts/read_meeting_data.py' allows for arbitrary local file reading and Server-Side Request Forgery (SSRF) as it lacks path sanitization or URL filtering. While these represent significant security flaws that could be exploited via prompt injection, they appear to be unintentional vulnerabilities rather than deliberate malware.
Capability Assessment
Purpose & Capability
The name/description ask for reading local files, directories, or URLs and listing meeting-note files; the included scripts implement exactly that. Required binaries, env vars, and config paths are none, which aligns with the stated functionality.
Instruction Scope
SKILL.md restricts behavior to reading files/URLs or listing directories and requires user-supplied locations. The runtime scripts follow that scope (reading files with multiple encodings, fetching URLs with requests, listing .md/.txt files). Note: the directory lister uses OS-native commands (find on Unix, PowerShell on Windows) invoked via subprocess; on Windows the PowerShell script embeds the provided path in a script string without escaping single quotes, which could be fragile or lead to mis-parsing for specially crafted paths. Also the reader will fetch arbitrary URLs (requests.get) which can leak metadata or contact external servers if the agent environment allows network access — this is expected for URL fetches but worth being aware of.
Install Mechanism
No install spec (instruction-only with included scripts). No downloads or external installers. Code files are included directly in the skill bundle, so nothing is fetched or executed at install time.
Credentials
The skill requests no environment variables or credentials. It does use the network (requests) to fetch URLs and runs local filesystem access, both of which are consistent with its purpose and do not require additional secrets.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide privileges or modify other skills. It reads only user-provided paths/URLs and lists directory contents; it does not write configuration or attempt to persist beyond its own execution.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install meeting-minutes-retriever - After installation, invoke the skill by name or use
/meeting-minutes-retriever - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
- Major refactor: streamlined skill to core functionality, removing 21 scripts, test cases, and documentation files.
- Added core file for reading meeting data (`read_meeting_data.py`) and a sample input (`sample_meeting_gbk.txt`).
- Removed previous audio generation, memory handling, and test automation scripts for a simplified workflow.
Metadata
Frequently Asked Questions
What is meeting-minutes-retriever?
Read meeting minutes or notes from a local file path or URL, or inspect a local meeting-notes directory and report the file count plus file list. Use when th... It is an AI Agent Skill for Claude Code / OpenClaw, with 217 downloads so far.
How do I install meeting-minutes-retriever?
Run "/install meeting-minutes-retriever" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is meeting-minutes-retriever free?
Yes, meeting-minutes-retriever is completely free, licensed under MIT-0. You can download, install and use it at no cost.
Which platforms does meeting-minutes-retriever support?
meeting-minutes-retriever is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created meeting-minutes-retriever?
It is built and maintained by 曹广雨 (@xiaocaijic); the current version is v1.0.0.
More Skills