ClawHub
Back to skill

Security audit

MeetGeek

Security checks for vulnerabilities and agentic risk

Overview

The skill is a straightforward MeetGeek CLI helper, but users should treat meeting data and the unpinned global npm install with care.

Install only if you trust the `meetgeek-cli` npm package and are comfortable granting it access to your MeetGeek API key and meeting content. Prefer a reviewed pinned version where possible, protect the saved API key, and avoid exporting transcripts to shared or unmanaged locations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding
Unpinned Global Installation of an External npm Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 13–17 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npm install -g meetgeek-cli ``` ``` ### Technical Analysis The installation instructions direct users to install `meetgeek-cli` globally from the public npm registry without specifying a reviewed version or verifying package integrity. Because no version is pinned, npm resolves the package version associated with the current distribution tag, normally `latest`, at installation time. The code executed by users can therefore change after this Skill has been reviewed. Global npm installation may also execute package lifecycle scripts, such as `preinstall`, `install`, or `postinstall`, with the privileges of the user running the command. The source code of `meetgeek-cli` is not included in the audited project. Consequently, its lifecycle scripts, credential handling, network destinations, and runtime behavior could not be verified as part of this audit. There is no evidence in the reviewed files that the dependency is currently malicious; the finding concerns the unsafe and mutable dependency installation process. ### Attack Path 1. An attacker compromises the npm account, publication pipeline, or upstream repository associated with `meetgeek-cli`, or otherwise causes a malicious release to become the version selected by npm. 2. The attacker publishes a release containing a malicious lifecycle script or malicious runtime code. 3. A user follows the documented command: ```bash npm install -g meetgeek-cli ``` 4. npm downloads the mutable, unpinned release and may execute its lifecycle scripts during installation. 5. The malicious code runs with the installing user's privileges. 6. It may access files available to that user, including the MeetGeek configuration identified by the Skill as `~/.config/meetgeek/config.json`. 7 ...[truncated 967 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin `meetgeek-cli` to an explicitly reviewed version rather than relying on the mutable `latest` tag: ```bash npm install -g meetgeek-cli@<reviewed-version> ``` 2. Verify the selected release before recommending it: - Review the package source and npm lifecycle scripts. - Confirm package ownership and provenance. - Record and verify the expected registry integrity digest. - Reassess the package whenever the pinned version is updated. 3. Prefer a project-local installation with a committed lockfile instead of a global installation: ```bash npm install --save-exact meetgeek-cli@<reviewed-version> ``` Commit the resulting lockfile so dependency versions and integrity values are reproducible. 4. Disable lifecycle scripts during installation where compatible with the package: ```bash npm install --ignore-scripts --save-exact meetgeek-cli@<reviewed-version> ``` 5. Include or vendor the reviewed CLI implementation with the Skill when feasible, allowing its credential handling, external communications, and command execution behavior to be audited together with the wrapper. 6. Execute the CLI with least privilege and restrict access to `~/.config/meetgeek/config.json`, for example by ensuring that only the owning user can read the file. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill enables access to highly sensitive meeting artifacts such as transcripts, summaries, action items, and cross-meeting search, but provides no privacy or data-handling warning. In practice, these materials often contain confidential business discussions, personal data, and credentials or secrets mentioned during calls, so omission of safeguards can lead users to expose or mishandle sensitive information.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The examples encourage exporting full meeting transcripts to local files without warning that the output may contain sensitive or regulated information. Saving transcripts to disk can create persistent plaintext copies that may be exposed through backups, shared home directories, endpoint compromise, or accidental disclosure.

Static analysis

No suspicious patterns detected.