Meeting Notes Assistant

会议纪要智能助手。使用本地 Whisper 音频转写（离线、隐私安全），生成结构化会议纪要（时间、议题、结论、待办、关键词），提取 Action Items。支持 Word / PDF / 邮件输出，适合录音转写、会议归档与待办分发。触发关键词：「整理会议纪要」、「生成会议纪要」、「录音转纪要」。

This package implements local transcription and structured note generation, but before installing you should: 1) Verify the source (there is no homepage and owner ID is unknown). 2) Inspect scripts that perform network I/O (model_downloader.py, any code that calls LLM endpoints, publish_feishu.py, send_email.py) to confirm what endpoints are contacted and how credentials are used/stored. 3) If you need strictly offline operation, run generate_notes.py with --no-llm and avoid configuring LLM/API keys; confirm transcribe_audio.py is used locally. 4) Verify the model download URL (openaipublic.azureedge.net...) and consider downloading model weights manually from a trusted source or checking checksums before use. 5) Be cautious storing API keys in ~/.workbuddy/meeting-notes-config.json — prefer environment variables with appropriate filesystem permissions or a secrets manager. 6) Consider running the package in an isolated environment (VM or container) for initial testing, and review FEISHU / email publishing code before enabling those integrations. 7) The unicode-control-chars finding in SKILL.md should be inspected — remove or normalise any suspicious invisible characters before use. If you want, I can highlight the specific files/functions that call external networks and show exactly where API keys would be read/written.

Type: OpenClaw Skill Name: meeting-notes-assistant Version: 1.0.0 The meeting-notes-assistant skill bundle is a legitimate and well-structured tool for offline audio transcription and meeting summarization. It utilizes the OpenAI Whisper model for local transcription and provides comprehensive scripts for exporting results to Word and PDF formats. Security-wise, the bundle demonstrates high awareness by including a dedicated 'input_validator.py' script designed to mitigate path traversal, command injection, and XSS risks. It stores configuration and local databases in a standard hidden directory (~/.workbuddy/) and uses hardcoded subprocess calls to its own internal scripts, minimizing execution risks. No evidence of data exfiltration, malicious persistence, or harmful prompt injection was found.