Repository navigation
Start of perfect meetings - #112
Conversation
![pi-security-bot[bot]](https://avatars.githubusercontent.com/in/1782801?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Review
Found two Medium issues: unaccepted external invitations can trigger unbounded Gmail/AI work, and attacker-controlled meeting content is combined with private email excerpts in a web-enabled agent prompt. No posture model covered this path; reachability is inferred from the automatic calendar trigger, with impact bounded to one installation and the agent's limited grants.
Pi · Helpful? Reply below to let us know! 🦣
| ? inclusiveEndDate(period.start.date, period.end.date) | ||
| : period.end.dateTime, | ||
| isAllDay, | ||
| cancelled: |
There was a problem hiding this comment.
Medium — Unaccepted invitations automatically consume Gmail and AI resources
responseStatus === "needsAction" remains scheduled, so an external sender can create unique invitations that are ingested without the user accepting them. Each resulting Meeting page triggers Gmail searches and a research session, allowing invite spam to consume AI credits and fill the databases. Require an explicit accepted/tentative RSVP before starting prep, and add per-user run limits.
Pi · Helpful? Reply below to let us know! 🦣
| agent_id: targets.agentId, | ||
| message: researchPrompt( | ||
| meeting, | ||
| withKnownNames(attendees, contacts, excerpts), |
There was a problem hiding this comment.
Medium — Attacker-authored meeting text shares an instruction channel with private email excerpts
An external organizer controls the meeting title/agenda and email senders control snippets; researchPrompt concatenates these with up to ten recent Gmail threads per attendee into the ordinary message of a web-enabled agent. An injected instruction can cause unrelated private excerpts to appear in outbound searches or attacker-chosen Markdown/links persisted by writeBrief. The agent has no page grants or trusted URLs, which bounds impact, but private email summarization should run in a web-disabled stage, external fields should be explicitly treated as untrusted, and persisted output should be restricted to plain text.
Pi · Helpful? Reply below to let us know! 🦣
Inline databases in APP.md must be parented to the App page, which the SDK cannot declare yet, so the home page links to them instead. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Rename the package to @notion-cookbook/perfect-meetings, add its catalog entry, match the apps-default agent files (AGENTS.md, CLAUDE.md, and .claude/skills as symlinks into .agents/), and format pnpm-workspace.yaml. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop the duplicate title heading and link the databases with Notion as Code mentions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2 participants
No description provided.