Security audit

MeetMatch Sales Coach

Security checks across malware telemetry and agentic risk

Overview

This sales-coaching skill appears purpose-aligned, but it handles sensitive employee and customer-call data with persistent profiling and scheduled outbound email that need review before use.

Review this before installing in a real sales environment. Confirm what data MeetMatch receives, who can access rep profiles, how long memory is retained, how users can disable or delete it, and whether scheduled email briefings require opt-in and verified recipients. This does not show clear malicious behavior, but it needs privacy and admin controls before broad deployment.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger examples are broad conversational phrases like "how's my day" and "brief me on my 2pm," which can plausibly appear in ordinary chat and may cause unintended invocation. In a skill with access to sales predictions, meeting details, and persistent rep memory, accidental activation could expose sensitive business context or perform actions the user did not explicitly intend.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises "persistent memory" that tracks each rep's patterns across calls but does not clearly warn users about ongoing retention, profiling, or the sensitivity of sales-call-derived behavioral data. In this context, the omission increases the risk of uninformed deployment, privacy noncompliance, and excessive trust in a feature that continuously accumulates potentially sensitive employee performance information.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly describes transmitting sensitive rep performance data, meeting schedules, risk scores, and transcript-derived coaching insights to an external MeetMatch service, and sending resulting briefings by email, but it does not prominently warn users about that data flow. This creates a real privacy and security risk because operators may enable the skill without understanding that employee performance data and potentially sensitive call-derived information leave the local agent environment and may be redistributed through email.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The keyword triggers are broad natural-language phrases that can overlap with ordinary conversation, increasing the chance the skill is invoked unintentionally. In this skill's context, accidental activation could expose sales coaching data, rep memory, schedules, and performance information to a user who did not explicitly intend to access MeetMatch-backed data.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill schedules hourly checks and may send morning email briefings automatically, but the user-facing prompt does not clearly warn that outbound emails will be sent without an explicit per-send confirmation. Because the content includes schedule details, coaching memory, and performance signals, undisclosed automatic delivery creates privacy, consent, and data-leakage risks if sent to the wrong recipient or at the wrong time.

Session Persistence

Medium

Category: Rogue Agent
Content: # MeetMatch Sales Coach Your OpenClaw agent knows how to write emails and search the web. This skill teaches it how to actually sell. MeetMatch Sales Coach connects your agent to real sales outcome data: which reps close which types of deals, who's at risk of a no-show, what coaching patterns emerge across hundreds of calls. Your agent doesn't just read a CRM. It taps into a prediction engine trained on your team's historical close data, then turns that into personalized coaching for every rep, every morning.
Confidence: 86% confidence
Finding: write emails and search the web. This skill teaches it how to actually sell. MeetMatch Sales Coach connects your agent to real sales outcome data: which reps close which types of deals, who's at risk

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.