Imposter Smasher for Events and Meetings

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed meeting-prep helper that uses calendar, web research, and audio services, with no evidence of hidden installation, persistence, exfiltration, or destructive behavior.

Install only if you are comfortable giving the agent access to next-day calendar details and allowing selected meeting context to be used with Contextual.ai and an audio provider such as ElevenLabs or Chatterbox. Avoid using it for confidential meetings unless you have approval for those third-party data flows.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code is a narrow packet-building utility, not an end-to-end meeting-prep skill. Its actual function is to transform supplied event/research JSON into three output files: an executive summary, an audio narration script, and a manifest indicating audio should be rendered later by another integration. The declared description claims broader workflow capabilities—discovering upcoming calendar events, asking the user to choose one, researching the meeting and attendees, and delivering a fully produced audio briefing. Those major capabilities are absent from this code chunk, making the description materially broader than the implementation shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a full meeting/event preparation workflow involving calendar data, participant/topic research, summarization, and production of an audio briefing. The actual code does none of those things. It only estimates narration duration for a text file and validates whether it fits a 3–5 minute target range. While this could conceivably support part of an audio-briefing pipeline, the supplied chunk’s primary purpose is materially different from the declared skill behavior and lacks the core declared capabilities and resource access. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement the described meeting/event briefing workflow. Instead, it is a project validation utility that inspects the repository for required files and required text in SKILL.md. Its primary purpose is build/scaffold validation, which is materially different from preparing a user for meetings or events. No declared capabilities are actually carried out by this code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 73% confidence

Finding

The skill declares broad capabilities and references helper scripts, file reads, and file writes, but does not define an explicit tool or permission boundary. In an agent setting, missing scope declarations can cause the runtime to grant broader-than-necessary file access, increasing the chance of unintended local data exposure or overwrite if the skill is invoked in a permissive environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly depends on external web research and audio-generation services while handling calendar events, attendees, and meeting context, yet it gives no user-facing warning that this potentially sensitive data may be transmitted to third parties. In a meeting-prep context, this can expose personal data, confidential business relationships, or strategic topics to external processors without meaningful informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.