Security audit

Nex MeetCost

Security checks across malware telemetry and agentic risk

Overview

This appears to be a disclosed local meeting-cost calculator with expected setup, CLI use, and local storage behavior.

Install only if you are comfortable running its setup script and allowing it to create local SQLite data. Review where it stores meeting rates or history, especially if those rates reveal sensitive compensation or billing information.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation advertises executable setup and CLI commands (`bash setup.sh`, `nex-meetcost ...`) and describes capabilities including local SQLite storage, but it declares no permissions. This creates a real transparency and enforcement gap: users or hosting platforms may believe the skill is passive while it can invoke shell commands, read environment context, and write local files/database content.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal