World Meeting Coordination Skill

Security checks across malware telemetry and agentic risk

Overview

This is a local meeting-time helper that discloses its small saved settings file and does not show hidden network, credential, or destructive behavior.

Install if you are comfortable with a local script saving your timezone, preferred meeting hours, and flexibility setting. On shared machines, review settings with --show-settings or delete the config file if you do not want those preferences retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documentation indicates file read/write capability through persistent settings stored under ~/.openclaw/skills/world-meeting-coordination-skill/config.json, but no permissions are declared. Undeclared filesystem access weakens transparency and consent, and could allow unexpected reading or modification of local data if the implementation expands beyond the documented config path.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose presents the skill as a timezone meeting-window formatter, but the content also describes interactive onboarding, persistent storage of user preferences, and retrieval of saved settings. This mismatch is security-relevant because users and reviewers may approve or invoke the skill without realizing it collects and stores personal scheduling preferences and timezone data on disk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal