ClawHub
Back to skill

Security audit

Meetup Planner

Security checks for vulnerabilities and agentic risk

Overview

This meetup-planning skill is mostly coherent, but it deserves review because it can create persistent scheduled searches and inspects installed skills outside its declared workspace.

Install only if you are comfortable with local storage of your event preferences, location, schedule, tracked events, and reminders, and with optional recurring background searches. Before enabling automation, ask to see the exact scheduled task and how to remove it, and avoid allowing the skill to inspect unrelated installed skills unless you explicitly approve that access.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Execution of an Unpinned npm Package During Installation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Note
Location
BOOTSTRAP.md:11
Finding

Installed Skill Enumeration Outside the Declared Filesystem Scope

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The bootstrap explicitly creates a persistent configuration file containing user preferences and state markers such as bootstrap completion and scheduling metadata. Session persistence is not inherently malicious, but here it increases privacy and security risk because behavioral preferences, location, and automation state remain on disk across sessions without clear consent, retention, or deletion controls.

Content

Scanner excerpt · BOOTSTRAP.md (reported line 69)May include surrounding context.

md
---

## 3) Create preferences file

Save all responses to `~/.openclaw/workspace/meetup-planner/config.json`:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The bootstrap stores detailed user interests, location, schedule, and requirements to disk without any privacy notice, retention policy, or minimization guidance. This creates unnecessary privacy risk because sensitive preference and location data may persist locally longer than the user expects and could be exposed through other local compromise or backup flows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BOOTSTRAP.md (reported line 118)May include surrounding context.

mkdir -p ~/.openclaw/workspace/meetup-planner/{events,backups}

Set proper permissions (owner only)

chmod 700 ~/.openclaw/workspace/meetup-planner chmod 600 ~/.openclaw/workspace/meetup-planner/config.json

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BOOTSTRAP.md (reported line 119)May include surrounding context.

Set proper permissions (owner only)

chmod 700 ~/.openclaw/workspace/meetup-planner chmod 600 ~/.openclaw/workspace/meetup-planner/config.json

text

Initialize empty data files:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The automation flow enables recurring searches and notifications, but the disclosure is framed as a convenience feature rather than a security-relevant persistent behavior change. Users should be explicitly warned that the skill will continue making periodic web activity and storing/updating state after setup, otherwise they may not understand the extent of ongoing autonomous behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The bootstrap instructs the agent to create a cron job or equivalent scheduled task for autonomous execution. Persistent background execution expands the skill's privileges and attack surface because it allows the skill to continue acting outside an active user session, potentially making web requests and processing data without a fresh user prompt each time.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BOOTSTRAP.md (reported line 232)May include surrounding context.

md
**Permissions errors:**
- Check file permissions with `ls -la`
- Fix with `chmod 600` or `chmod 700`

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · BOOTSTRAP.md (reported line 232)May include surrounding context.

md
**Permissions errors:**
- Check file permissions with `ls -la`
- Fix with `chmod 600` or `chmod 700`

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill prominently advertises automated web searching and scraping, but the README does not clearly warn that user interests, locations, and search queries may be transmitted to third-party search engines, event sites, or scraping targets. Because the skill is personalized and runs automatically, it can expose behavioral and location-related data without users fully understanding the privacy implications.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The README instructs users to run npx clawhub@latest install meetup-planner, which fetches and executes the latest package version at install time without pinning. This creates a supply-chain risk: if the package or one of its dependencies is compromised later, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

git clone https://github.com/apresmoi/meetup-planner.git

Copy to your Claude skills directory

mkdir -p ~/.claude/skills/meetup-planner cp -r meetup-planner/* ~/.claude/skills/meetup-planner/

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

git clone https://github.com/apresmoi/meetup-planner.git

Copy to your Claude skills directory

mkdir -p ~/.claude/skills/meetup-planner cp -r meetup-planner/* ~/.claude/skills/meetup-planner/

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The README indicates the skill relies on cron-based scheduled tasks for reminders and automated searches, which establishes persistence beyond the immediate user session. Persistent scheduled execution increases risk because future web access and scraping may continue automatically, potentially after the user forgets it was enabled or after configuration changes introduce unsafe behavior.

Content

Scanner excerpt · README.md (reported line 137)May include surrounding context.

md
- Verify your search and scraping tools are working

**Reminders not working:**
- Verify cron job is set up: `crontab -l`
- Check `~/.openclaw/workspace/meetup-planner/reminders.json` for scheduled reminders

**Tool errors:**

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The skill explicitly instructs the agent to automatically run a bootstrap process after installation and to always check bootstrap status before any other action. Even if the setup is framed as interactive, this creates autonomous behavior that can trigger capability checks, file reads, workspace creation, and potentially further actions from BOOTSTRAP.md without an explicit user request at invocation time.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
## One-time Setup

**IMPORTANT**: After installing this skill, the agent will automatically run the bootstrap setup process from `BOOTSTRAP.md`.

The bootstrap process:
1. Checks for web search and crawling capabilities

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill establishes persistent local storage under ~/.openclaw/workspace/meetup-planner/ and later directs the agent to maintain long-lived files for preferences, events, reminders, config, and backups. This persistence is not inherently malicious, but it creates retained behavioral and interest data over time, increases privacy exposure, and can support unattended future actions such as scheduled searches and reminders.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
1. ✅ Check for web search and crawling capabilities
2. 🎯 Learn your event preferences through a friendly conversation
3. ⏰ Set up automated daily searches (optional)
4. 📁 Create workspace structure with proper permissions

**Setup takes 2-3 minutes**. If you don't have search/crawling tools installed, I'll ask you to provide them.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package.json (reported line 46)May include surrounding context.

json
"entryPoint": "SKILL.md",
  "install": {
    "preInstall": {
      "message": "⚠️  SETUP REQUIRED\n\nBefore installing this skill:\n1. Ensure you have web search and scraping tools/skills available\n2. Review required permissions\n\nThis skill will:\n- Create files in ~/.openclaw/workspace/meetup-planner/\n- Set up cron jobs for scheduled tasks (optional)\n- Use whatever search and scraping capabilities you have installed\n\nContinue only if you trust this source.",
      "confirm": true
    },
    "postInstall": {

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The skill directs the agent to inspect the global skills directory to discover installed search and scraping capabilities. Enumerating unrelated installed skills exceeds the minimum needed for a meetup planner and can reveal environment details or create unnecessary coupling to other capabilities that were not explicitly granted for this task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.