MeetGeek

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent MeetGeek CLI helper, but it uses an external npm CLI and a MeetGeek API key that can access sensitive meeting content.

This skill appears purpose-aligned and not malicious from the provided artifacts. Before installing, make sure you trust the meetgeek-cli npm package, understand that the configured API key can expose your MeetGeek meeting content, and clear the saved key when you no longer want the CLI or agent to access it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone or anything using the configured CLI may be able to retrieve meeting information available to that API key.

Why it was flagged

The skill requires a MeetGeek API key and stores it locally so the CLI can access the user's MeetGeek account data. This is expected for the integration, but it is sensitive account authority.

Skill content

meetgeek auth   # Interactive API key setup
Get your API key from: MeetGeek → Integrations → Public API Integration
...
API key stored in: `~/.config/meetgeek/config.json`

Recommendation

Use an API key only for an account you intend the agent/CLI to access, protect the config file, and run `meetgeek auth --clear` when access is no longer needed.

Note

ASI06: Memory and Context Poisoning

What this means

Meeting text may be displayed to the agent, terminal, or saved files, making sensitive call content easier to expose or reuse unintentionally.

Why it was flagged

The skill retrieves and searches meeting transcripts and summaries, which can contain private business, personal, or customer information. This is core to the stated purpose but broad enough that users should treat outputs carefully.

Skill content

Get full transcript
...
Search across all recent meetings
meetgeek ask "what did we discuss about the budget"
...
Transcripts include speaker names and timestamps

Recommendation

Prefer meeting-specific queries when possible, avoid requesting unnecessary private transcripts, and handle exported transcript files as sensitive documents.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the npm package gives that CLI code local execution ability and access to the configured MeetGeek API key.

Why it was flagged

The skill relies on installing an external global npm CLI. This is normal for a CLI integration, but users are trusting that package in addition to the small wrapper included in the artifact.

Skill content

npm install -g meetgeek-cli

Recommendation

Install from the linked package/source you trust, consider pinning a known version, and review package provenance before configuring the API key.