Meeting Scheduler Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

This meeting assistant is mostly coherent, but it needs Review because it defaults to broad automatic processing of calendar, Gmail, web, and local meeting-history data before stronger opt-in and source-isolation controls are shown.

Install only if you are comfortable giving the workflow access to Google Calendar and, if enabled, Gmail context. Before use, consider turning off auto_prep, include_email_context, and include_web_search until you need them; verify the gog CLI source before installing it globally; review local meeting-notes regularly; and confirm exact recipients, event IDs, and message bodies before approving any calendar update, task sync, or email send.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:17

Finding

Unpinned Global Installation of a Privileged Third-Party CLI

Content

View full analysis

/dev/null; then echo "❌ gog CLI not found." echo " Install it via OpenClaw or run: npm install -g gog" exit 1 fi ``` The same unsafe installation guidance appears in the Skill documentation: ```markdown ### "gog: command not found" Install gog: `npm install -g gog` or check your OpenClaw installation — gog should be bundled. ``` ### Technical Analysis The project recommends globally installing a package identified only by the short npm package name `gog`. It does not provide: - A verified publisher or official package URL. - A pinned, audited package version. - A package integrity digest or signature. - A lockfile or reproducible installation mechanism. - A validation step confirming the installed executable's identity. A global npm installation may run package lifecycle scripts with the installing user's permissions. If the package name resolves to an unintended, compromised, or malicious release, arbitrary code can execute during installation. The resulting executable is subsequently trusted to authenticate with Google and process calendar and Gmail data. This substantially increases the consequences of a supply-chain compromise. ### Attack Path 1. A user runs `scripts/setup.sh`. 2. The script reports that `gog` is missing and recommends `npm install -g gog`. 3. npm resolves a compromised, malicious, or unintended package release. 4. Package lifecycle scripts execute with the user's local privileges during installation. 5. The installed executable is later used for `gog auth login`. 6. The malicious executable gains an opportunity to access OAuth authorization data and calendar or Gmail content processed t ...[truncated 806 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:207

Finding

Untrusted Calendar, Email, Note, and Web Content Is Processed Without Prompt-Injection Isolation

Content

View full analysis

"` for past meetings and `gog gmail search --query "from:"` for recent emails. ``` The retrieved content is then used to generate externally writable material: ```markdown 2. **Review past meeting notes** with same attendee(s) 3. **Check for open action items** from previous meetings 4. **Allocate time proportionally** based on meeting duration 5. **Include standing items** (check-in, next steps) for recurring meetings 6. **Add open questions** from recent email threads or notes #### Sharing Agendas Add the agenda to the calendar event description via `gog calendar events update`, email it to attendees via `gog gmail send`, or both. Always ask the user: "Want me to add this to the invite, email it, or both?" ``` ### Technical Analysis Calendar titles and descriptions, incoming email bodies, local notes, and web search results can contain text controlled by external parties. The Skill directs an action-capable AI agent to consume this content but does not instruct it to: - Treat retrieved content strictly as untrusted data. - Ignore instructions embedded in calendar entries, emails, notes, or web pages. - Separate trusted Skill instruction ...[truncated 2857 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes access to Google Calendar data and downstream generation of agendas, follow-up tasks, and emails, but it does not clearly warn users that the skill may process sensitive scheduling metadata, contact details, meeting context, and derived content. In an agentic workflow, lack of explicit privacy and action-impact disclosure can cause users to authorize broad access or allow automated externalized actions without understanding the data exposure and modification risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup flow instructs the agent to collect and persist user configuration in config/settings.json but does not tell the user that data will be stored locally, what fields will be retained, or whether the file may contain sensitive scheduling metadata. This creates a privacy and consent issue, especially if the environment is shared, synced, or backed up automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill recommends searching company news and pulling recent email threads with attendees for prep without a clear privacy disclosure or consent checkpoint. That can cause the agent to process sensitive communications and third-party personal data beyond what the user reasonably expects during basic scheduling setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Automatically generating prep briefs for upcoming meetings means the agent may proactively inspect calendar details, attendee information, emails, and related context on an ongoing basis without a prominent warning during setup. This increases privacy risk because background processing can continue after initial configuration and may involve sensitive business or personal meeting data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes automated meeting prep using Google Calendar, Gmail search, web search, and optional relationship-history sources, but it does not clearly warn users that sensitive calendar and email data may be accessed and processed automatically. This creates a real privacy and consent issue because users may enable or invoke the skill without understanding the scope of data access, increasing the chance of overcollection or unexpected exposure of personal or business information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that follow-up notes and meeting history are saved locally and then reused for future prep, but it does not provide a clear warning about local retention of potentially sensitive meeting content, decisions, and action items. This is dangerous because users may not realize that confidential business notes and personal data persist on disk, where they could later be accessed by other local users, backups, or unrelated tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The spec explicitly states that meeting, contact, and follow-up metrics are persistently stored and historically retained, but it provides no user-facing notice, consent model, retention limit, or access controls. Because these metrics reveal work habits, relationship patterns, and potentially sensitive behavioral data, silent long-term collection increases privacy and compliance risk if the data is exposed, misused, or retained beyond user expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as triggering when a calendar event ends, without clearly limiting activation to meetings the user explicitly wants processed. In this context, that can cause the agent to initiate follow-up workflows after unrelated or sensitive events, increasing the chance of unintended note capture, task creation, scheduling, or outbound communication based on the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description does not upfront disclose that it may create tasks, send email, save meeting notes locally, queue scheduling requests, and potentially use external integrations. This lack of transparency weakens informed consent and can lead users to authorize what seems like a passive summarization flow when it actually performs state-changing local and external actions involving potentially sensitive meeting content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The on-demand trigger phrase "Prep me for my 10 AM" is underspecified and can cause the agent to act on ambiguous natural-language requests without clear confirmation of which meeting or which data sources should be used. In a skill that aggregates calendar, email, notes, and relationship data, broad triggering increases the chance of pulling sensitive context for the wrong meeting or surfacing private information unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that it uses Gmail, Google Calendar, meeting notes, web search, and relationship-history data, but it does not present a clear user-facing warning or consent boundary for accessing privacy-sensitive information. This creates a real risk of users receiving synthesized personal or business-sensitive data without understanding what sources were queried or whether all participants would expect that information to be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file explains that the agent pulls calendar events and creates a meeting invite, which affects user data and an external attendee. The description does not include any warning or disclosure about accessing calendar contents, using attendee email addresses, or modifying the user's calendar.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script retrieves calendar events and may print them to stdout or write them to a file, which can expose sensitive meeting titles or details. While the header says it exports meetings, there is no explicit warning, confirmation, or privacy notice around the data access and export behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script header states it only validates prerequisites and initializes configuration, but it also scans for other installed skills and silently enables cross-skill integrations by modifying settings.json. This hidden behavior reduces transparency and can expand access to additional user data sources or automations without explicit user consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 109)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 110)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 111)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 112)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SECURITY.md (reported line 57)May include surrounding context.

md

## Recommendations

1. **Review gog permissions:** Ensure you've granted only the scopes you're comfortable with (Calendar read/write, Gmail read)
2. **Audit meeting notes regularly:** The `meeting-notes/` directory accumulates context over time. Review and prune as needed.
3. **Disable email context if sensitive:** If your email contains highly sensitive information, set `prep.include_email_context: false` in settings.json
4. **Disable web search if private:** If you don't want attendee names used in web searches, set `prep.include_web_search: false`

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file header describes the script as a 'Weekly Agenda Generator' that generates a week-ahead meeting prep document, but the implementation also reads settings from a local JSON config to incorporate availability policy into the output. In addition, the generated report directs the agent to check a local 'meeting-notes/' directory for past interactions, which expands the skill toward broader contextual data access beyond simply listing calendar events for an agenda.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code performs a file write using a user-supplied path and truncates any existing file via shell redirection. While the script's usage comments show that a custom output path is supported, there is no confirmation prompt or explicit warning that an existing file may be overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.