Meetlark - coordinate a meeting

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

This scheduling skill is mostly purpose-aligned, but it tells the agent to retain a private poll admin token in memory without clear secrecy, retention, or deletion controls.

Review before installing. The skill can create polls and manage them through a private admin token; use it only if you are comfortable with the agent retaining that token, and avoid exposing poll links or admin tokens in chats, logs, or summaries.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:14
• Finding: Administrative Bearer Token Stored in Unspecified Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 14–18 **Vulnerability Type**: Sensitive credential retained in insecure or unspecified storage **Risk Level**: Medium **Vulnerable Code**: ```markdown ## Two Tokens When you create a poll you get two tokens: - **Admin token** (`adm_...`) — Private. View full results, see who voted, close the poll. Store it in your memory for the poll's lifetime. - **Participate token** (`prt_...`) — Shareable. Anyone with the participate URL can vote — humans via the web UI, agents via the API. Multiple people use the same link. ``` ### Technical Analysis The Skill explicitly directs the Agent to store the poll's administrative bearer token in “your memory.” This storage location has no defined confidentiality controls, isolation guarantees, retention limits, deletion procedure, or protection against later context or memory disclosure. The administrative token is security-sensitive because it authorizes access to full poll results, participant identities, and individual votes, and it permits poll closure. Retaining such a token in conversational or persistent Agent memory violates least-retention principles and increases its exposure beyond the operation for which it is immediately required. This finding concerns insecure credential handling rather than Agent Memory Poisoning: the stored value is a credential, not an attacker-controlled rule intended to alter future Agent behavior. ### Attack Path 1. The Agent creates a poll through the external service and receives an `adm_...` administrative token. 2. Following the instruction in `SKILL.md`, the Agent stores that token in its unspecified memory for the poll's lifetime. 3. The credential remains available beyond the immediate API operation and may become accessible through later memory retrieval, context exposure, logging, or a malicious prompt that induces disclosure. 4. An unauthorized party obtains the retained toke ...[truncated 801 chars]
• Remediation: ## Remediation Suggestions - Remove the instruction to place administrative tokens in conversational or general-purpose Agent memory. - Keep each token only in ephemeral, poll-scoped state for the shortest period required. - If cross-session access is essential, use an approved encrypted secret store with strict access controls instead of Agent memory. - Never include the token in user-visible responses, model prompts, logs, telemetry, or long-term memory. - Define an explicit retention period and delete the token immediately after poll closure or expiration. - Document server-side token expiration and provide token revocation or rotation. - Request explicit user confirmation before retrieving identity-level voting data or closing a poll. - Redact administrative credentials from errors and diagnostic output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to store the private admin token in memory for the poll's lifetime, but provides no warning about its sensitivity, retention limits, or restrictions on later disclosure. Because the admin token grants privileged poll access and control, persistent agent memory increases the chance of unintended exposure through later prompts, logs, summaries, or cross-task context reuse.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Poll creation requires a verified email (one-time, valid for 30 days of activity).

Use `?autoVerify=true` — if the email is unverified, the API automatically sends a verification email and returns:
```json
{
  "error": {

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.