Security audit

Skill Vexa

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate Vexa meeting-bot integration, but its optional webhook automation can turn meeting events into agent instructions that write persistent local memory and create/share sensitive meeting artifacts.

Install only if you are comfortable giving this skill access to Vexa meeting bots, transcripts, recordings, and local report storage. Before using it in real meetings, confirm participant consent and your workplace policy. Keep webhook automation disabled unless you need it; if enabled, review generated reports and any memory/entities changes before relying on them, and use --no-share for meeting bundles unless you intentionally want a transcript share link.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The onboarding helper can read the local OpenClaw hook token from configuration and then send a forged POST to the local /hooks/vexa endpoint. Even though this is framed as a test utility, it crosses a trust boundary by impersonating a privileged webhook source and can inject synthetic meeting-completed events into the local agent pipeline, potentially triggering downstream ingestion or automation on false data.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The transform is triggered by webhook data but instructs the downstream agent to do more than generate a report: it also updates persistent entity memory files based on meeting-derived content. That expands the trust boundary from event filtering into state mutation, creating a path for untrusted webhook-originated content to influence long-term memory and potentially poison future agent behavior or records.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file comments claim the hook only creates a basic meeting report, but the actual generated instructions direct additional actions including entity-file updates and possible meeting-chat behavior. This mismatch is security-relevant because reviewers and operators may approve or rely on the narrower documented behavior while the runtime prompt grants broader capabilities, increasing the risk of hidden or unintended side effects from webhook-triggered execution.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The CLI exposes voice-agent prompt configuration operations that go beyond the declared meeting-bot/transcript/recording/report scope. Allowing arbitrary prompt changes can alter downstream agent behavior, potentially causing unsafe instructions, data leakage, or unauthorized expansion of capability if users trust the skill description as a boundary.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill can set an arbitrary user webhook URL even though this capability is not disclosed by the manifest description. This creates a hidden exfiltration surface because meeting events, transcripts, or related metadata could be redirected to an attacker-controlled endpoint if a user invokes the command without understanding its scope.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to send bots into live meetings and collect transcripts and recordings, but it does not present an upfront privacy/consent warning. In this context, that omission is material because meeting capture can implicate consent laws, workplace policies, and disclosure obligations, making accidental misuse more likely.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script writes full meeting transcripts and metadata to a local markdown file under the current workspace without any consent gate, minimization, or retention controls. Because transcripts can contain sensitive business discussions, participant names, links, and decisions, this creates a real confidentiality risk if the workspace is shared, synced, indexed, or later exposed.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The meetings:bundle command creates a transcript share link by default unless --no-share is supplied. Because transcripts and recordings are sensitive meeting artifacts, default link creation can unintentionally broaden access and expose confidential content without a clear opt-in warning.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/onboard.mjs:256

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vexa.mjs:185

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/audit.mjs:20

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ingest.mjs:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/onboard.mjs:28

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/vexa.mjs:36