← 返回 Skills 市场
217
总下载
0
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install meeting-minutes-retriever
功能描述
Read meeting minutes or notes from a local file path or URL, or inspect a local meeting-notes directory and report the file count plus file list. Use when th...
安全使用建议
This skill appears to do what it says: read meeting files or list meeting-note files. Before installing, consider the following: (1) The skill will read any local file path you provide and will fetch any URL you provide — only give it paths/links you trust. (2) The directory lister uses OS commands via subprocess; on Windows the PowerShell command embeds the path without escaping single quotes which could be fragile or potentially abused if untrusted paths are supplied. (3) Run the skill in a restricted/sandboxed environment if possible (limited filesystem access, limited network egress) and review the scripts if you need higher assurance. If you want a safer fix, replace shell-based listing with purely Python directory enumeration or ensure the path is properly escaped/validated before calling PowerShell.
功能分析
Type: OpenClaw Skill
Name: meeting-minutes-retriever
Version: 1.0.0
The skill contains a critical command injection vulnerability in 'scripts/list_meeting_files.py' where the 'location' parameter is unsafely interpolated into a PowerShell command string. Additionally, 'scripts/read_meeting_data.py' allows for arbitrary local file reading and Server-Side Request Forgery (SSRF) as it lacks path sanitization or URL filtering. While these represent significant security flaws that could be exploited via prompt injection, they appear to be unintentional vulnerabilities rather than deliberate malware.
能力评估
Purpose & Capability
The name/description ask for reading local files, directories, or URLs and listing meeting-note files; the included scripts implement exactly that. Required binaries, env vars, and config paths are none, which aligns with the stated functionality.
Instruction Scope
SKILL.md restricts behavior to reading files/URLs or listing directories and requires user-supplied locations. The runtime scripts follow that scope (reading files with multiple encodings, fetching URLs with requests, listing .md/.txt files). Note: the directory lister uses OS-native commands (find on Unix, PowerShell on Windows) invoked via subprocess; on Windows the PowerShell script embeds the provided path in a script string without escaping single quotes, which could be fragile or lead to mis-parsing for specially crafted paths. Also the reader will fetch arbitrary URLs (requests.get) which can leak metadata or contact external servers if the agent environment allows network access — this is expected for URL fetches but worth being aware of.
Install Mechanism
No install spec (instruction-only with included scripts). No downloads or external installers. Code files are included directly in the skill bundle, so nothing is fetched or executed at install time.
Credentials
The skill requests no environment variables or credentials. It does use the network (requests) to fetch URLs and runs local filesystem access, both of which are consistent with its purpose and do not require additional secrets.
Persistence & Privilege
always is false and the skill does not request persistent/system-wide privileges or modify other skills. It reads only user-provided paths/URLs and lists directory contents; it does not write configuration or attempt to persist beyond its own execution.
如何使用
- 确保已安装 OpenClaw（本地或 Docker 部署）
- 在对话框中输入安装命令：
/install meeting-minutes-retriever - 安装完成后，直接呼叫该 Skill 的名称或使用
/meeting-minutes-retriever触发 - 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
- Major refactor: streamlined skill to core functionality, removing 21 scripts, test cases, and documentation files.
- Added core file for reading meeting data (`read_meeting_data.py`) and a sample input (`sample_meeting_gbk.txt`).
- Removed previous audio generation, memory handling, and test automation scripts for a simplified workflow.
元数据
常见问题
meeting-minutes-retriever 是什么？
Read meeting minutes or notes from a local file path or URL, or inspect a local meeting-notes directory and report the file count plus file list. Use when th... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 217 次。
如何安装 meeting-minutes-retriever？
在 OpenClaw 或 Claude Code 对话框中运行命令「/install meeting-minutes-retriever」即可一键安装，无需额外配置。
meeting-minutes-retriever 是免费的吗？
是的，meeting-minutes-retriever 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。
meeting-minutes-retriever 支持哪些平台？
meeting-minutes-retriever 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。
谁开发了 meeting-minutes-retriever？
由 曹广雨（@xiaocaijic）开发并维护，当前版本 v1.0.0。
推荐 Skills