Security audit

meeting-notetaker

Security checks across malware telemetry and agentic risk

Overview

This skill is useful for meeting prep, but it asks the agent to use local Google credentials, source a local context file, and optionally modify monday.com boards, so it needs review before installation.

Install only if you expect this skill to access your Google Calendar credentials, calendar events, attendees, and monday.com Notetaker data. Review the local .context file before use, avoid access ALL unless explicitly needed, and approve monday.com item creation only after confirming the exact board and items.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill loads a local .context file and instructs the agent to source variables such as owner email, calendar ID, and credentials, which expands access beyond simple note retrieval into sensitive local configuration handling. This is dangerous because it enables implicit use of secrets and local state without clear user consent or strong scope controls, increasing the chance of unauthorized data access or cross-skill secret exposure.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The manifest describes a monday.com Notetaker retrieval skill, but the implementation adds a separate Google Calendar lookup workflow for 'next meeting' mode. This scope expansion is risky because users invoking a notes skill may not expect calendar access, and the agent may process attendee and schedule data unrelated to the requested notetaker function.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill explicitly directs use of a direct Google Calendar API with a local credentials file and named account despite claiming monday.com Notetaker-only scope. This is dangerous because it instructs the agent to access privileged credentials and another service directly, creating a clear path to unauthorized calendar data access and misuse of stored secrets.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill is presented as fetching and presenting notes, but it also offers to create items on monday.com boards, changing user data rather than just reading it. This broadens the blast radius from read-only summarization to write actions, which can cause unintended modifications if triggered without strong confirmation and board-scoping safeguards.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill accesses local context and secret-bearing environment values without any user-facing disclosure that sensitive files or credentials may be read. This is risky because users cannot make an informed decision about privacy-sensitive access, and hidden secret consumption can violate trust and internal data-handling expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions call for direct use of Google Calendar credentials to retrieve calendar data, but there is no explicit privacy notice or consent mechanism for accessing meeting schedules and attendee information. Calendar metadata is sensitive, and silently accessing it can expose personal or business information beyond the user's expectations.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.