Skipup - AI Meeting Scheduling

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:26 PM UTC
• Version: 1.0.0

Overview

This is a disclosed SkipUp scheduling integration that sends meeting details and participant emails to SkipUp, with no hidden local persistence or unrelated behavior found.

Install only if you intend your agent to send meeting details and participant email addresses to SkipUp and allow SkipUp to contact participants by email. Use a scoped API key, avoid sending sensitive meeting context unless necessary, and require clear user confirmation before creating, cancelling, pausing, or resuming requests.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (31)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs the agent to send organizer and participant email addresses plus meeting context to a third-party API, but it does not clearly warn about data sharing, consent, or handling of potentially sensitive meeting metadata. In an agent setting, this can lead to users or deployers transmitting personal data or confidential business context off-platform without adequate notice or policy review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to activate on ordinary scheduling language such as 'book a meeting' or 'set up a call,' which can cause the agent to route routine conversation into a third-party scheduling workflow. In this skill, activation can lead to external email outreach and disclosure of participant data, so overbroad invocation meaningfully increases the risk of unintended actions and privacy-impacting transmissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

Creating a meeting request sends organizer and participant emails plus meeting context to an external service, which is a real data egress path. In this skill, that transmission is the core behavior, but it still poses privacy and misrouting risk if invoked without explicit consent or if sensitive meeting details are included.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Create a meeting request

text

POST https://api.skipup.ai/api/v1/meeting_requests

Returns 202 Accepted. SkipUp will coordinate asynchronously via email.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

Listing meeting requests queries externally hosted records that can include participant emails, statuses, and timestamps, so it is a genuine outbound request with potential privacy implications. In an agent setting, broad or implicit invocation could expose more organizational scheduling metadata than the user intended to retrieve.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

List meeting requests

text

GET https://api.skipup.ai/api/v1/meeting_requests

Returns a paginated list of meeting requests, newest first. Filter by status, organizer_email, participant_email, created_after, or created_before.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

Retrieving a meeting request from an external service is a real data-access operation that may disclose participant identities and meeting lifecycle details. In this context, the danger is not the HTTPS endpoint itself but that an agent may fetch and reveal third-party scheduling data without sufficiently verifying user authorization or need-to-know.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Get a meeting request

text

GET https://api.skipup.ai/api/v1/meeting_requests/:id

Retrieves a single meeting request by ID.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Listing workspace members sends a query to an external system and can reveal internal employee emails and roles, which are sensitive organizational directory data. In an agent context, easy access to membership lookups increases the risk of unintended disclosure or enumeration if user intent is ambiguous.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

List workspace members

text

GET https://api.skipup.ai/api/v1/workspace_members

Returns a paginated list of active workspace members. Filter by email or role.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 3)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 217)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 249)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/examples.md (reported line 295)May include surrounding context.

md

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/index.ts (reported line 4)May include surrounding context.

ts

# API reference

Base URL: `https://api.skipup.ai/api/v1`

All requests require a Bearer token:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples demonstrate actions with real external side effects—creating, cancelling, pausing, and resuming meeting requests, emailing participants, and transmitting personal data—without any upfront safety notice or operator confirmation guidance. In an agent-skill context, this omission can cause an automated system to execute user-like examples as live actions or normalize behavior that sends data to third parties without clear consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This example sends organizer and participant email addresses plus meeting context to an external API and initiates participant outreach, creating a real-world side effect beyond the local system. In isolation this is normal API documentation, but in a skill consumed by agents it is dangerous because it lacks guardrails around consent, test-vs-production usage, and confirmation before contacting third parties.

Content

Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.

Request:

bash

curl -X POST https://api.skipup.ai/api/v1/meeting_requests \
  -H "Authorization: Bearer $SKIPUP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This example sends organizer and participant email addresses plus meeting context to an external API and initiates participant outreach, creating a real-world side effect beyond the local system. In isolation this is normal API documentation, but in a skill consumed by agents it is dangerous because it lacks guardrails around consent, test-vs-production usage, and confirmation before contacting third parties.

Content

Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.

Request:

bash

curl -X POST https://api.skipup.ai/api/v1/meeting_requests \
  -H "Authorization: Bearer $SKIPUP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This example transmits participant identities, names, scheduling details, and requests introduction emails to an external service, increasing both data exposure and unsolicited third-party contact risk. The rich context and automatic outreach make the example more dangerous in an agent setting if executed without explicit consent and confirmation.

Content

Scanner excerpt · references/examples.md (reported line 56)May include surrounding context.

Request:

bash

curl -X POST https://api.skipup.ai/api/v1/meeting_requests \
  -H "Authorization: Bearer $SKIPUP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This example sends cross-timezone participant data and meeting context to an external service to coordinate scheduling, which involves disclosure of personal/workplace information and automated processing. While expected for the product, it is still a real external transmission with side effects that should not be silently embedded in agent behavior.

Content

Scanner excerpt · references/examples.md (reported line 106)May include surrounding context.

Request:

bash

curl -X POST https://api.skipup.ai/api/v1/meeting_requests \
  -H "Authorization: Bearer $SKIPUP_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/index.ts:115