Security audit

Join meeting

Security checks across malware telemetry and agentic risk

Overview

This is a broad but openly documented meeting-bot skill that connects an agent to video calls, with sensitive features users should understand before use.

Install only if you are comfortable letting your agent join calls, receive transcripts, speak, chat, request screenshots, and share local webpages through AgentCall. Use it in trusted meetings or with strict agent permissions, avoid exposing sensitive localhost services, and review/clean up saved API keys and any transcript or audio logs created by examples.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (98)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill exercises powerful capabilities including shell, network, file read/write, and environment access, yet declares no permissions or trust boundaries. In practice this obscures the real blast radius from users and hosting frameworks, increasing the chance the skill is invoked without appropriate consent, sandboxing, or policy controls.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose is joining meetings, but the document also enables account registration, API-key handling, arbitrary coding-agent actions, local web hosting, screenshots, chat operations, raw audio handling, and public tunnel exposure. That mismatch can cause the skill to be selected in situations where the user expected a narrow meeting action, while actually granting a broad remote-interaction and data-exfiltration surface.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to read files, run commands, edit code, search the codebase, and commit changes while participating in a live meeting driven by participant speech. Because meeting transcripts are untrusted input, this turns ordinary meeting conversation into a channel that can trigger privileged coding-agent actions in the local environment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The participant-facing webpage hosting feature exposes localhost-served content through a shareable tunnel URL, which extends the skill from meeting participation into ad hoc web publishing. If the local server contains sensitive routes, debug endpoints, or generated data, meeting participants or anyone with the link may access content the user did not intend to expose.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The README explicitly frames the meeting bridge as a new I/O channel while preserving the agent's ability to read files, edit code, and run commands from spoken input. That meaningfully expands the effective privilege of a 'join meeting' skill because any participant who can influence transcript or chat content may drive high-impact actions through a less trustworthy channel.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Promoting commits and pushes to remote repositories from a voice-meeting workflow extends the skill from conferencing into source-control operations that can alter or exfiltrate code. Spoken instructions are error-prone and can be influenced by other meeting participants, making repository-changing actions especially risky without additional safeguards.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to persist an API key to ~/.agentcall/config.json, creating long-lived local credentials unrelated to the narrow act of joining a single meeting. Persisting secrets across sessions increases exposure to later compromise, accidental reuse, and unauthorized access by other local processes or users.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The post-call cleanup directs the agent to kill local processes and make direct API lifecycle calls, extending behavior beyond simple meeting participation into host/process management. Even though it advises tracking PIDs instead of sweeping broadly, these instructions still normalize potentially destructive local actions and remote state changes that can be misapplied or abused.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The bridge implements a hidden screenshot capability that is not disclosed in the documented stdin/stdout protocol. In this skill context, screenshots can capture participant identities, shared screens, code, secrets, or internal documents from a live meeting, so undocumented support increases the chance that operators or downstream agents invoke sensitive collection without informed consent or proper policy controls.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README documents capabilities that go well beyond simply joining and participating in meetings, including querying company data and creating external tickets. This expands the effective authority of the skill without corresponding disclosure in the manifest description, increasing the risk that users or integrators grant it broader trust than intended.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The documentation describes saving meeting logs and retaining meeting-derived context for later reference, but this persistence behavior is not reflected in the stated skill purpose. Hidden or under-disclosed retention of transcripts and derived data can expose sensitive business or personal information and undermine informed consent.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The README encourages extending the meeting assistant with Slack messaging, which introduces a new outbound communication/action channel unrelated to merely attending meetings. That broadening of capability increases the blast radius for prompt injection, mistaken task execution, or abuse of connected enterprise systems.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill writes full transcripts, participant names, and voice-state details to a local markdown file by default. Meeting data often contains sensitive business or personal information, so retaining it without explicit consent, minimization, or retention controls creates a meaningful privacy and data exposure risk.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: This file extends a meeting-join skill with broad business-operation capabilities including database access, document retrieval, calculations, and ticket creation. In the context of an agent whose stated purpose is to join and participate in calls, these extra capabilities increase the attack surface and could let meeting participants or prompt-injected transcript content trigger access to internal data or side-effecting actions beyond what is necessary for meeting participation.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The create_ticket capability enables persistent external side effects from meeting content, allowing the agent to create tasks or tickets based on transcript-derived queries. Because meeting speech can be ambiguous, manipulated by participants, or prompt-injected, this can lead to unauthorized workflow changes, spam ticket creation, or fraudulent action items being recorded in external systems.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script writes participant names, full transcript content, and voice-event text to a local markdown file by default. Meeting data often contains sensitive business or personal information, so persisting it without minimization, consent controls, or storage protections increases the risk of privacy leakage and unauthorized local disclosure.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The README documents a workflow that captures full meeting audio, participant information, and sends that data to a third-party model provider for transcription and summarization. That is materially more sensitive than simply joining or participating in a meeting, and it creates a privacy and data-governance risk if users rely on the skill's higher-level description and do not realize external processing and retention may occur.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Documenting an option to save raw meeting audio for records introduces storage of highly sensitive content that exceeds the minimal meeting-bot function. Persisted recordings increase the blast radius of compromise, may violate participant expectations or policy, and create legal/compliance exposure if retention and consent are not clearly defined.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The script writes full meeting transcripts, participant names, and meeting metadata to an unencrypted local markdown file. This creates a confidentiality risk because sensitive meeting content may be stored on disk without explicit user disclosure, retention controls, or access protections, and could later be accessed by other local users, backup systems, or malware.

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The example expands the skill from merely joining a meeting into recording, transcript processing, summarization, and persistence of meeting content. That scope expansion matters because users may rely on the manifest description for consent and risk evaluation, and hidden recording/processing behavior can materially change privacy and compliance exposure.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The README instructs users to send full meeting transcripts to third-party LLM providers, but that external data transfer is not reflected in the join-meeting skill description. This creates a meaningful confidentiality risk because sensitive meeting content may be exfiltrated to external processors without clear up-front disclosure, vendor review, or user consent expectations.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script persists a full meeting transcript and summary to a local markdown file, which can expose sensitive business, legal, or personal information to other local users, backups, sync tools, or malware on the host. In a meeting-join skill, retaining conversation content is a meaningful expansion of data handling and creates confidentiality risk even if it is intended as a note-taking feature.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The file adds LLM-based transcript summarization, which sends meeting contents to a separate model provider when enabled. That is a material capability beyond simply joining a meeting, and it increases exposure because sensitive transcript data may leave the primary service boundary and be processed by third parties.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The agent writes full customer conversation transcripts to a local markdown file, including potentially sensitive support content, without any notice, consent flow, retention policy, or access controls. In a support context this can expose PII, account details, or confidential business information to other local users, backups, or endpoint compromise.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code accepts remote WebSocket messages and forwards arbitrary HTTP methods, paths, headers, and bodies to a localhost service, effectively creating a general-purpose tunnel into local services. In the context of a meeting-joining skill, this capability is broader than necessary and could expose admin panels, debug endpoints, or internal APIs bound only to localhost if the tunnel server or credentials are compromised.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: examples/meeting-assistant-smart/tools.py:93

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/notetaker-simple/notetaker.js:29

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: examples/notetaker-smart/notetaker.js:34

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/node/agentcall.js:24

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/node/bridge-visual.js:125

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/node/bridge.js:50