Security audit

meeting-load-balancer

Security checks for vulnerabilities and agentic risk

Overview

This is a local calendar-audit skill, but it has a real terminal-output safety issue when displaying untrusted calendar text.

Install only if you are comfortable running a local Python script over sensitive calendar exports. Use ICS files from trusted sources, avoid displaying attacker-controlled calendar content in a permissive terminal, and prefer a patched version that escapes control characters before printing event titles, attendee names, filenames, or other ICS-derived text.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/meeting_load.py:446
Finding: Unsanitized ICS Fields Allow Terminal Escape-Sequence Injection
Content: View full analysis
4.0f}min {o['summary'][:40]} " f"({len(o['attendees'])}ppl)") ``` ### Technical Analysis ICS files must be treated as untrusted input because they can originate from external meeting organizers, shared calendars, or files supplied by another person. The application imports `SUMMARY` and attendee `CN` values and prints them without escaping terminal control characters. Truncating a string does not make it safe. ANSI CSI sequences and terminal OSC sequences can fit within the imposed output limits. Depending on terminal support and configuration, malicious values could: - Clear or rewrite displayed output. - Move the cursor and visually conceal legitimate results. - Display misleading audit recommendations. - Create deceptive c ...[truncated 1698 chars]
Remediation: View remediation
4.0f}min {safe_summary[:40]} " f"({len(o['attendees'])}ppl)") ``` 3. Apply the same protection to summaries, attendee names, attendee addresses, UIDs, filenames, and any future calendar-derived values printed by `stats`, `rank`, `prescribe`, `team`, and `list`. 4. Remove or visibly escape C0 and C1 controls, including ESC, BEL, carriage return, backspace, and newline. Consider escaping Unicode bidi-control and zero-width formatting characters to reduce visual spoofing. 5. Add regression tests containing representative hostile values: - `\x1b[2J` for screen clearing. - `\x1b]52;c;...` for clipboard operations. - OSC 8 hyperlink sequences. - Embedded carriage returns and newlines. - Unicode bidirectional override characters. 6. Document that calendar files are untrusted data and that all human-readable output must pass through the terminal-safe renderer. ]]>

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.