Meeting Scheduler Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.3

Overview

The skill is a coherent meeting assistant, but it defaults to broad automated Calendar, Gmail, web-search, local-note, and cross-skill data use that users should review carefully before installing.

Install only if you are comfortable granting Calendar read/write and possibly Gmail read access. Before using it, review config/settings.json, disable email context or web search if meetings are sensitive, verify gog comes from a trusted OpenClaw source rather than a bare unpinned npm package, and check the local meeting-notes directory and dashboard retention periodically.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:524

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:524-527
Vulnerability Type: Supply-chain risk caused by an unpinned global dependency
Risk Level: Medium

Vulnerable Code

markdown

### "gog: command not found"
Install gog: `npm install -g gog` or check your OpenClaw installation — gog should be bundled.

The same unsafe recommendation is repeated in scripts/setup.sh:17-22:

bash

# Check gog CLI
echo "Checking gog CLI..."
if ! command -v gog &>/dev/null; then
    echo "❌ gog CLI not found."
    echo "   Install it via OpenClaw or run: npm install -g gog"
    exit 1
fi

Technical Analysis

The project recommends installing the latest npm package named gog globally without:

• Pinning a reviewed version
• Verifying package provenance or publisher identity
• Checking an integrity hash or signature
• Using a lockfile
• Restricting npm lifecycle scripts

The setup script does not execute the installation automatically, which limits immediate exploitability. However, users are explicitly directed to run the command when the required executable is unavailable.

A global npm installation can execute package lifecycle scripts with the privileges of the invoking user. Because this tool is subsequently expected to access Google Calendar and potentially Gmail, a malicious, compromised, replaced, or incorrectly identified package could impersonate the expected CLI and capture sensitive data or authorization material.

Attack Path

1. An attacker compromises the referenced npm package, publishes a malicious version under the expected name, or causes users to resolve an unintended package.
2. A user runs the documented npm install -g gog command.
3. npm retrieves the current package version and may execute attacker-controlled lifecycle scripts.
4. The package installs a globally available gog executable under the user's environment.
5. The user follows the project instructions and invokes commands such as gog auth login, `gog c ...[truncated 1066 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the bare package name with a link to the verified official distribution and clearly identify its publisher and repository.
2. Pin installation to a reviewed version, for example:

   bash

   npm install -g gog@<reviewed-version>
   

3. Publish and verify the expected package integrity hash or cryptographic signature.
4. Prefer installation through OpenClaw's trusted, bundled distribution when available.
5. Avoid elevated installation and explicitly warn users not to run the command with sudo.
6. Consider disabling lifecycle scripts during installation where compatible:

   bash

   npm install -g gog@<reviewed-version> --ignore-scripts
   

7. After installation, validate the executable path, package version, publisher, and checksum before requesting Google authentication.
8. Apply the same hardened guidance to both SKILL.md:524-527 and scripts/setup.sh:17-22.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt recommends searching web news and pulling recent email threads about attendees without any privacy, consent, or data-minimization warning. This can lead to collection and processing of sensitive personal or business information beyond what users or meeting participants expect, especially if the feature is enabled by default or framed as 'recommended.'

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Stating that the agent will automatically generate prep briefs for upcoming meetings implies ongoing background access to calendar and possibly related contextual data, but no warning is given about continuous automated processing. In this skill context, the danger is elevated because meeting prep may aggregate attendee, email, and web data, creating persistent privacy and surveillance concerns if users do not understand the automation scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly describes automated access to sensitive sources including Google Calendar, Gmail, relationship notes, local meeting history, and optional web search, but it does not present a prominent privacy warning or consent boundary before using that data for prep. This can lead users to unknowingly expose personal, professional, and third-party information through aggregation and summarization, increasing privacy and confidentiality risk even if the feature is intended.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Preparation and follow-up features are broadly enabled, including web search, email context collection, task creation, and draft email generation, but the configuration does not define explicit trigger conditions, approval gates, or scope limits. In an agent skill, this can cause over-collection of sensitive context or unintended autonomous actions after meetings, especially if the skill operates on external events or ambiguous scheduling inputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The spec explicitly states that meeting, follow-up, and contact-related metrics persist in a dashboard data store and that historical data is retained, but it does not describe any user notice, consent, retention limits, access controls, or deletion behavior. Because these metrics can reveal work patterns, relationships, and behavioral history, silent long-term retention creates a real privacy and governance risk even if the data is collected for legitimate dashboard functionality.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes an agent that automatically reacts when a meeting ends, parses free-form conversation into tasks, drafts and sends email, writes meeting notes, and queues scheduling actions. If the activation condition for this post-meeting workflow is ambiguous, the agent could trigger on the wrong event or without sufficiently clear user intent, causing unintended task creation, note storage, outreach, or disclosure of sensitive meeting content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The on-demand trigger phrase ('Prep me for my 10 AM') is underspecified and could cause the agent to retrieve or generate a briefing for whichever meeting it heuristically associates with that time, including the wrong person's calendar event or overly broad contextual data. In a skill that aggregates calendar, email, meeting notes, web search, and relationship data, ambiguous invocation increases the chance of unintended data access or disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states that it pulls from sensitive sources including Gmail, meeting notes, calendar history, and relationship-tracking data, and the example output includes personal and business-sensitive context without any visible privacy notice, consent boundary, or minimization statement. This makes accidental over-collection, unexpected cross-source profiling, and disclosure of confidential information more likely, especially when preparing summaries that may be viewed or shared in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example depicts the agent reading calendar data and creating or modifying events, including sending invites, without any explicit user warning, consent checkpoint, or confirmation of side effects at the moment of action. In a scheduling skill, these are real state-changing operations involving sensitive personal data and external communication, so normalizing silent execution increases the risk of unintended calendar changes, privacy exposure, or accidental invites.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script’s stated purpose is prerequisite validation and configuration initialization, but it also silently mutates integration flags in settings.json based on the presence of sibling skills. This is a behavior-transparency issue: users may not expect setup to enable cross-skill integrations automatically, which can broaden data access or downstream behavior without explicit consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 109)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 110)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 111)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 112)May include surrounding context.

sh

# Set script permissions
echo ""
echo "Setting script permissions..."
chmod 700 "$SCRIPT_DIR/setup.sh"
chmod 700 "$SCRIPT_DIR/export-schedule.sh"
chmod 700 "$SCRIPT_DIR/weekly-agenda.sh"
echo "✅ Scripts set to chmod 700."

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The header comments describe this as a 'Weekly Agenda Generator' that 'Generates a week-ahead meeting prep document'. However, the generated report explicitly tells the user to later 'Review each meeting above and generate prep briefs' and to run it through an agent for the actual prep, meaning the script itself only assembles a schedule summary/template rather than producing the meeting prep document it claims to generate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The markdown states that the skill captures action items, creates tasks, and drafts follow-up emails after meetings. Because this involves processing and propagating meeting-derived information to other systems or artifacts, a brief privacy/data-handling warning would help users understand the impact on their data.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SECURITY.md (reported line 57)May include surrounding context.

md

## Recommendations

1. **Review gog permissions:** Ensure you've granted only the scopes you're comfortable with (Calendar read/write, Gmail read)
2. **Audit meeting notes regularly:** The `meeting-notes/` directory accumulates context over time. Review and prune as needed.
3. **Disable email context if sensitive:** If your email contains highly sensitive information, set `prep.include_email_context: false` in settings.json
4. **Disable web search if private:** If you don't want attendee names used in web searches, set `prep.include_web_search: false`

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The setup prompt instructs the agent to save configuration to config/settings.json, but it does not explicitly warn the user before writing to disk or obtain clear confirmation immediately before the write. While this is expected behavior for a setup flow, silent persistence can surprise users and normalize unannounced local data storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill says users can change availability conversationally and implies the agent will update settings and create blocks, but it does not clearly warn that these actions modify local configuration and may place new events or restrictions on the calendar. Users may unintentionally alter scheduling behavior or create blocking events without understanding the persistence and side effects of those commands.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setting forces the locale-specific timezone "America/New_York" and provides no indication that users can opt into a different locale or that the restriction is intentionally region-specific. This can violate language/locale policy expectations when a skill assumes one locale by default for all users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This shell script performs a file write using a user-supplied path at L106. While it prints a status message after writing, there is no prior warning, confirmation, or comment disclosing that an existing file may be overwritten when a custom output path is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.