Fulcra Meeting Briefing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 0.1.1

Overview

The skill is coherent and privacy-aware, but it asks users to run an unpinned external CLI while handling private calendar and CRM data.

Review this before installing. Use only a vetted, pinned version of the Fulcra CLI from a trusted source, avoid running it in an environment with unrelated secrets or broad file access, and keep calendar, CRM, attendee, token, and location details out of shared outputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Fulcra CLI Package Execution in Skill Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34–44
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

uv tool run fulcra-api user-info
uv tool run fulcra-api data-updates "1 day"
uv tool run fulcra-api calendar-events "1 day"
uv tool run fulcra-api calendars

Before using new auth or calendar options, inspect live help:

bash

uv tool run fulcra-api auth login --help
uv tool run fulcra-api calendar-events --help
uv tool run fulcra-api data-updates --help

Technical Analysis

The workflow directs the agent or user to execute fulcra-api through uv tool run without specifying an exact reviewed version, dependency lockfile, package hash, or verified distribution source. The executable package resolved at runtime can therefore differ from the version that existed when the skill was audited.

This creates a software supply-chain trust boundary: if the upstream package, publisher account, dependency graph, or configured package registry is compromised, a malicious release may be selected and executed. The use of live command help as the authority for supported behavior further means that runtime package behavior is trusted without a locally reviewed specification.

There is no evidence in the audited project that the current fulcra-api package is malicious. The vulnerability is the absence of controls preventing an altered or compromised future package from being executed.

Attack Path

1. An attacker compromises the package publisher, upstream dependency, or package registry used to resolve fulcra-api.
2. The attacker publishes a malicious version under the expected package identity or modifies a transitive dependency.
3. A user or agent follows the documented workflow and runs uv tool run fulcra-api ... without an exact version or integrity constraint.
4. The package manager resolves and executes the attacker-controlled release.
5. The malicious process runs ...[truncated 1025 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin fulcra-api to a reviewed, exact version rather than resolving the latest available release at runtime.
2. Maintain a lockfile that records the complete dependency graph and use integrity hashes where supported.
3. Configure uv to use an explicitly trusted package index and prevent fallback to untrusted or unintended indexes.
4. Document the expected package publisher, source repository, version, and release verification process.
5. Review dependency updates before changing the pinned version, including transitive dependencies and release artifacts.
6. Prefer a reproducible installation step followed by execution of the verified local environment, rather than resolving a package independently on every command.
7. Run the CLI with least privilege and restrict access to unrelated credentials, files, and environment variables.
8. Where practical, apply network egress controls so the CLI can communicate only with required Fulcra and authentication endpoints.

T08 · Insecure Dependencies

Warning

• Location: README.md:17

Finding

README Recommends Runtime Execution of an Unpinned CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 17–18
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown

- Authenticate Fulcra through the CLI. Preferred command: `uv tool run fulcra-api`.
- Before broad calendar pulls, run `uv tool run fulcra-api data-updates "1 day"` when available, then confirm with `calendar-events`.

Technical Analysis

The setup instructions recommend invoking fulcra-api through uv tool run without an exact version, dependency lock, integrity hash, or verified package source. A user following these instructions may resolve and execute package contents that were not part of the audited repository and that can change independently after the audit.

Because the command is used for authentication and calendar retrieval, the external package executes in a context where sensitive data is likely available. The project contains privacy guidance, but those rules cannot constrain arbitrary code inside a compromised dependency.

No evidence establishes that the current upstream package is malicious. The confirmed weakness is that the documented setup provides no reproducibility or integrity control over the executable dependency.

Attack Path

1. An attacker gains control of the upstream package, a transitive dependency, a publisher account, or the package source selected by the user's configuration.
2. The attacker distributes a malicious package version.
3. A user follows the README and invokes uv tool run fulcra-api without a pinned version.
4. The malicious version is resolved and executed under the user's account.
5. During authentication or calendar retrieval, the process can attempt to capture authentication data and private calendar content available to it.
6. The process can access or alter other resources permitted to the invoking user and may exfiltrate collected information through its network access.

Impact Assessment

A successful ...[truncated 550 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the unversioned command with an exact, reviewed package version.
2. Provide a reproducible installation procedure using a committed lockfile and integrity verification.
3. State the trusted package index and verified upstream publisher explicitly.
4. Include an update policy requiring security review before changing the pinned version.
5. Advise users to execute the CLI in a least-privileged environment with access only to necessary calendar and CRM resources.
6. Keep authentication tokens out of command output, logs, generated briefings, and shared channels.
7. Consider distributing or referencing a cryptographically verified artifact so users do not rely on mutable runtime resolution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to execute uv tool run fulcra-api without pinning a specific package version or immutable source. That can cause users to fetch and run whatever version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published later.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This second command also runs fulcra-api as an unpinned tool, so the behavior and code executed may change over time without review. In a skill that handles private calendar and CRM data, a compromised upstream package could exfiltrate sensitive information or alter briefing output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase 'Use this skill when the user wants upcoming-meeting prep, same-day meeting intel, next-day meeting briefings, attendee research, or CRM-assisted relationship context' is descriptive but does not define specific trigger phrases, boundaries, or exclusions for activation. Terms like 'attendee research' and 'relationship context' are broad enough to overlap with common requests outside the intended meeting-briefing scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill repeatedly instructs use of uv tool run fulcra-api without pinning a specific package version or artifact. That means execution depends on whatever version is currently resolved at runtime, creating a supply-chain risk where a newly published, compromised, or incompatible release could be fetched and run in the user's environment with access to private calendar and CRM context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This invocation is unpinned and causes the skill to rely on the latest resolvable fulcra-api package rather than a reviewed version. In a skill that processes private meetings, attendees, and CRM notes, executing an unexpected package version could leak sensitive data or alter outputs silently.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

Running uv tool run fulcra-api without version pinning exposes users to dependency confusion or malicious upstream updates. Because this command is part of the normal workflow, it increases the chance that users routinely execute an unreviewed binary before accessing sensitive calendar data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill directs users to invoke an external CLI with no version constraints, so behavior and trustworthiness can change over time without any skill update. In the context of authenticated data access, that is a meaningful supply-chain exposure rather than a harmless documentation issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using an unpinned CLI even for --help still requires resolving and executing whatever package is available at runtime. Although the immediate action is lower risk than querying data, it still creates a path for arbitrary code execution from an unexpected package version.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This help command is also unpinned, so the user may execute a different package version than intended. The risk is somewhat reduced because the command is informational, but it still trusts mutable upstream code in a sensitive workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Even though this invocation is for help text, it still executes the external tool without a version lock. In a skill handling private enterprise context, that creates avoidable exposure to compromised or incompatible releases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This unpinned invocation is part of the core workflow and may run before or during processing of real meeting targets. If the resolved package is malicious or altered, it could exfiltrate calendar freshness data, credentials, or environment context and mislead downstream briefing generation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.