claw://Meetup

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:22 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent event-finding helper that asks for limited location details and requires user approval before reminders, messages, persistence, or scheduling.

Before installing, be aware that this skill may ask for your city or postal code and may use web/event searches. Only approve persistent preferences, scheduled reminders, cron entries, calendar-like actions, or sending share text if you actually want those actions performed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md

- Search in the smallest useful scope first, then widen only if needed.
- Keep the output useful, specific, and easy to act on.
- Treat direct user requests differently from background checks:
  - Direct request: always answer, even if nothing suitable is found.
  - Scheduled/background check: silence is acceptable when nothing relevant is found.
- Never recommend, summarize, or remind about past events.
- Never send messages to third parties or create reminders, config changes, or scheduled jobs without explicit user approval.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- Direct request: always answer, even if nothing suitable is found.
  - Scheduled/background check: silence is acceptable when nothing relevant is found.
- Never recommend, summarize, or remind about past events.
- Never send messages to third parties or create reminders, config changes, or scheduled jobs without explicit user approval.
- Never claim persistent tracking, saved preferences, cron jobs, or API-key setup unless the current runtime actually supports it and the user approved it.
- Treat location data conservatively. Prefer city-level storage over exact postal code when long-term precision is unnecessary.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/state-and-reminders.md (reported line 24)May include surrounding context.

md

## What not to store in memory files

- API keys
- access tokens
- exact unnecessary location detail
- anything that implies a reminder exists when it has not actually been created

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The line instructs loading this file for broad requests like wanting 'the best option' or a 'shortlist,' which are common phrases that may appear in many unrelated conversations. In a skill system that uses natural-language activation, this can cause unintended invocation of the meetup ranking behavior outside its intended event-selection context, leading to irrelevant responses or incorrect tool routing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The help template includes the trigger phrase "events near me," which is very broad and overlaps with normal conversational language. In an agent/router context, this can cause the meetup skill to activate unexpectedly on generic location-based event queries, leading to misrouting, unintended tool use, or unnecessary collection/use of location context.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger text says to load this file when the user asks for 'real event discovery, broader coverage, or when the first search pass is weak.' Phrases like 'broader coverage' and 'first search pass is weak' are subjective and do not clearly define when this strategy should or should not activate, which can lead to over-invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.