Doro Email To Calendar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:54 PM UTC
• Version: 1.0.0

Overview

The skill matches its email-to-calendar purpose, but it asks for broad email/calendar authority, installs recurring behavior, mutates mailbox state automatically, and contains a command-injection bug.

Install only if you are comfortable granting access to read Gmail content, create/update/delete calendar events, mark or archive emails, and store email-derived metadata locally. Review or disable direct inbox scanning, auto-disposition of emails, heartbeat integration, auto-create patterns, and deadline email notifications before use. The command-injection path in event tracking should be fixed before running validation workflows on untrusted or shared state.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: BOOT.md:38

Finding

Persistent Modification of Shared Agent Heartbeat Instructions

Content

View full analysis

Vulnerability Details

File Location: BOOT.md:38-74
Vulnerability Type: Persistent agent memory poisoning
Risk Level: High

Vulnerable Code

markdown

### 3. Check Heartbeat Integration

Read `~/.openclaw/workspace/HEARTBEAT.md` and ensure it contains:
- "Email Check" or "Email Scanning" section with calendar notification exclusion
- "Pending Calendar Invites" section

## Heartbeat Sections to Add

If the following sections are not present in HEARTBEAT.md, add them:

```markdown
## Email Scanning (email-to-calendar skill)
During email check cycle:
1. **IGNORE calendar notification emails** - DO NOT process emails from `[e-mail]`
   - These include: "Accepted:", "Declined:", "Tentative:", "Updated invitation:", "Cancelled:"
   - These are just notifications about responses to existing invites, NOT new events
   - Run `~/.openclaw/workspace/skills/email-to-calendar/scripts/process_calendar_replies.sh` to auto-archive them
2. Check for other unread emails with event indicators (dates, times, meeting keywords)
3. If events found, extract and present to user for selection
4. **ALWAYS use wrapper scripts** - NEVER call `gog` directly
5. Created events are tracked; user can undo within 24 hours
6. Log all scanning activity silently for audit trail

markdown

## Pending Calendar Invites (email-to-calendar skill)
If pending invites exist (check during email check cycle):
1. Run: `~/.openclaw/workspace/skills/email-to-calendar/scripts/list_pending.sh --summary`
2. If pending invites found with status "pending" and future dates:
   - List them to the user: "You have X pending calendar invite(s) that need your decision:"
   - Present each with: title, date, source email
   - Ask: "Reply with numbers to create, 'all', or 'dismiss' to clear them"
3. Based on user response:
   - Selected numbers: Create events using create_event.sh, update status to "created"
...[truncated 2281 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all instructions that automatically modify HEARTBEAT.md or other shared agent memory.
2. Present heartbeat integration as an optional configuration snippet instead of an automatic bootstrap step.
3. Require explicit, informed user approval before installing any recurring mailbox workflow.
4. Store scheduling configuration in a Skill-owned file rather than shared agent instructions.
5. Clearly disclose the frequency, mailbox queries, mutation behavior, retained data, and removal procedure.
6. Provide a command that completely unregisters the recurring behavior and removes only the Skill-owned configuration.
7. Default recurring processing to disabled and read-only operation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: BOOT.md:91

Finding

Bootstrap Self-Check Silently Performs Mutating Mailbox Operations

Content

View full analysis

Vulnerability Details

File Location: BOOT.md:91-92
Vulnerability Type: Unauthorized mailbox mutation during bootstrap
Risk Level: Medium

Vulnerable Code

bash

# Process any unread calendar notification emails
~/.openclaw/workspace/skills/email-to-calendar/scripts/process_calendar_replies.sh 2>/dev/null || true

The same file describes the invoked operation as follows:

markdown

**IGNORE calendar notification emails** from `[e-mail]`:
- Subject patterns: "Accepted:", "Declined:", "Tentative:", "Updated invitation:", "Cancelled:"
- These are responses to existing invites, NOT new events to create
- Run `process_calendar_replies.sh` to auto-archive them

Technical Analysis

A bootstrap self-check should normally verify prerequisites without changing user data. Here, the bootstrap instructions invoke process_calendar_replies.sh without its documented --dry-run option. The operation searches unread calendar-notification messages and dispositions them, which can mark messages as read or archive them according to configuration.

Standard error is redirected to /dev/null, and || true suppresses failure status. This makes the mutating action less visible and prevents the calling workflow from reliably reporting partial failures or classification errors.

Although processing calendar replies is related to the Skill's stated purpose, performing it automatically during bootstrap does not establish task-specific user consent for each mailbox mutation.

Attack Path

1. The Skill enters its first-activation or self-check workflow.
2. The agent invokes process_calendar_replies.sh without --dry-run.
3. The script searches the authenticated mailbox for messages matching notification criteria.
4. Matching messages are passed to the email-disposition workflow.
5. The messages may be marked read, archived, or both.
6. Errors are hidden by standard-error ...[truncated 645 chars]

Remediation

View remediation

Remediation Suggestions

1. Make bootstrap and capability checks strictly read-only.
2. Invoke process_calendar_replies.sh --dry-run by default.
3. Display the message IDs, senders, subjects, and proposed label changes before performing mutations.
4. Require explicit user confirmation before marking messages read or archiving them.
5. Do not suppress errors with 2>/dev/null || true; return structured failures to the user.
6. Use exact sender validation and conservative subject matching to reduce false positives.
7. Record each confirmed mutation in a visible audit log and provide a recovery procedure where the provider supports one.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/utils/event_tracking.py:170

Finding

Shell Command Injection in Orphaned Event Cleanup

Content

View full analysis

Vulnerability Details

File Location: scripts/utils/event_tracking.py:170-172
Vulnerability Type: OS command injection through shell=True
Risk Level: High

Vulnerable Code

python

subprocess.run(
    f'{script_dir}/delete_tracked_event.sh --event-id "{event_id}"',
    shell=True, capture_output=True
)

The wrapper reaches this operation when validation is requested:

bash

python3 "$UTILS_DIR/event_tracking.py" lookup \
    --type "$SEARCH_TYPE" \
    --value "$SEARCH_VALUE" \
    --validate "$VALIDATE" \
    --script-dir "$SCRIPT_DIR"

Technical Analysis

The cleanup operation constructs a command string by interpolating script_dir and event_id, then passes the result to a command shell. Double quotes around event_id do not provide safe shell argument encoding: an event ID containing a double quote followed by shell syntax can terminate the quoted argument and inject an additional command. An unsafe script_dir can likewise alter the command itself.

event_id is read from persistent events.json records. The tracking API does not enforce an allowlist for event-ID characters before storing or using this value. Consequently, a poisoned tracking record can become an execution payload when lookup_event.sh --validate identifies that record as orphaned.

Most other provider operations correctly pass argument arrays to subprocess.run, making this isolated shell=True path unnecessary.

Attack Path

1. An attacker or compromised local process places a malicious event_id in the event-tracking data. A representative structure would contain shell metacharacters that terminate the quoted --event-id value.
2. The user or agent runs lookup_event.sh --validate, or another workflow invokes equivalent validation.
3. The Skill searches the calendar and fails to find the poisoned event, classifying it as orphaned.
4. The orphan cleanup branch interpolates the mali ...[truncated 1049 chars]

Remediation

View remediation

Remediation Suggestions

Remove shell interpretation and pass each argument separately:

python

cleanup_script = os.path.realpath(
    os.path.join(script_dir, "delete_tracked_event.sh")
)

subprocess.run(
    [cleanup_script, "--event-id", event_id],
    capture_output=True,
    text=True,
    check=False,
)

Additional hardening should include:

1. Resolve and validate cleanup_script against the canonical expected Skill directory.
2. Reject symbolic-link or traversal-based paths that escape that directory.
3. Validate event IDs against the provider's documented identifier format and maximum length.
4. Avoid invoking another process entirely where possible; call delete_tracked_event(event_id) directly.
5. Treat tracking files as untrusted input and validate their schema when loading.
6. Add regression tests containing quotes, semicolons, command substitutions, newlines, and whitespace in both relevant values.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/utils/json_store.py:41

Finding

Sensitive JSON State Is Written Without Restrictive Permissions or Atomic Replacement

Content

View full analysis

Vulnerability Details

File Location: scripts/utils/json_store.py:41-56
Vulnerability Type: Insecure sensitive-data storage and non-atomic file writes
Risk Level: Medium

Vulnerable Code

python

def save_json(filepath: str, data: Any, indent: int = 2) -> None:
    """
    Save data as JSON to a file.

    Creates parent directories if they don't exist.

    Args:
        filepath: Path to the JSON file
        data: Data to serialize as JSON
        indent: Indentation level (default: 2)
    """
    filepath = os.path.expanduser(filepath)
    ensure_dir(filepath)

    with open(filepath, 'w') as f:
        json.dump(data, f, indent=indent)

The corresponding directory creation also does not specify a restrictive mode:

python

def ensure_dir(filepath: str) -> None:
    """Ensure the directory for a file path exists."""
    Path(filepath).parent.mkdir(parents=True, exist_ok=True)

Technical Analysis

The shared JSON writer persists event IDs, calendar IDs, source email IDs, email subjects, event summaries, pending invitations, activity logs, and change history. New directories and files inherit permissions from the process umask rather than explicitly enforcing private access.

On a system with a permissive umask or pre-existing broadly accessible directories, other local users may be able to read this metadata. Existing files also retain their previous permissions because the writer does not correct them.

The function's module documentation claims to provide atomic writes, but it opens the destination with mode w. This truncates the existing file before serialization finishes. A process interruption, disk-full condition, or concurrent writer can therefore leave an empty, partial, or inconsistent JSON file. Callers frequently treat invalid JSON as default empty state, potentially concealing corruption and weakening duplicate detection, activity history, or undo track ...[truncated 1204 chars]

Remediation

View remediation

Remediation Suggestions

1. Create Skill state directories with mode 0700.
2. Create state files with mode 0600 using os.open and explicit permission flags.
3. Correct permissions on existing directories and files after verifying ownership.
4. Write JSON to a temporary file in the same directory, flush it, call os.fsync, and atomically replace the destination with os.replace.
5. Apply the restrictive mode to the temporary file before writing sensitive content.
6. Use file locking or another serialization mechanism to prevent concurrent lost updates.
7. Do not silently interpret malformed state as empty state; preserve the corrupt file, report the error, and fail safely.
8. Consider minimizing retained email metadata and define a clear retention or deletion policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (47)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest explicitly advertises 'silent activity logging' while the skill handles email content and calendar operations, both of which are privacy-sensitive domains. Logging user activity without a clear warning, consent mechanism, retention policy, or scope limitation can expose sensitive email metadata or contents and creates substantial privacy and compliance risk.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/gog-commands.md (reported line 96)May include surrounding context.

md

| Thursday | TH |
| Friday | FR |
| Saturday | SA |
| Sunday | SU |

## Key Flags

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Validation logic in an event-tracking helper should not execute an external script from a caller-supplied directory, yet this code does exactly that when an orphaned event is detected. Because the path is externally influenced and invoked through the shell, the feature expands the attack surface from simple data lookup into arbitrary code execution.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a classic tool-parameter abuse issue: untrusted parameters are passed into a shell command that invokes another tool/script. In the skill context, where arguments may originate from upstream agent actions or user-controlled content, an attacker could manipulate script_dir or event_id to run unintended commands or scripts on the host.

Content

Scanner excerpt · scripts/utils/event_tracking.py (reported line 170)May include surrounding context.

python

else:
                            print(f"Orphaned event detected: {event_id} - removing from tracking", file=sys.stderr)
                            if script_dir:
                                subprocess.run(
                                    f'{script_dir}/delete_tracked_event.sh --event-id "{event_id}"',
                                    shell=True, capture_output=True
                                )

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · BOOT.md (reported line 13)May include surrounding context.

md

Verify the agent can:
- Read emails (list unread, get message body)
- Create calendar events
- Update/delete calendar events

If any capability is missing, inform the user:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The bootstrap directs the skill to modify a global HEARTBEAT.md file to install persistent behavior outside the immediate execution of the email-to-calendar task. Even if intended for convenience, this creates cross-session persistence and expands the skill's influence into broader agent behavior without explicit per-user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The bootstrap tells the agent to create or modify HEARTBEAT.md if sections are missing, but provides no requirement to notify the user or obtain consent before changing persistent global configuration. This is dangerous because it silently alters future agent behavior and can normalize hidden persistence mechanisms.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The self-check commands create directories and initialize pending_invites.json automatically, causing filesystem writes without notifying the user. Undisclosed writes are risky because they establish persistent state, may store sensitive invite metadata, and can surprise users who expect read-only analysis during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The configuration indicates emails may be marked read or archived automatically, but the skill description shown here does not clearly warn users that processing can modify mailbox state. This can lead to unexpected loss of visibility or workflow disruption if important messages are silently dispositioned.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 225)May include surrounding context.

md

### Fixed
- Stale forward handling: Old emails forwarded today are now properly processed.
- Orphaned events: Events deleted in Google Calendar are now automatically removed from tracking.

## [1.5.0] - 2026-02-02

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 245)May include surrounding context.

md

### Fixed
- Stale forward handling: Old emails forwarded today are now properly processed.
- Orphaned events: Events deleted in Google Calendar are now automatically removed from tracking.

## [1.5.0] - 2026-02-02

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · CHANGELOG.md (reported line 244)May include surrounding context.

md

## [1.4.0] - 2026-02-02

### Added
- **Selective Selection**: Users can now cherry-pick events by number (e.g., '1, 2, 3'), 'all', or 'none' instead of binary yes/no confirmation
- **Self-Healing Tracking**: When updating an event that was deleted externally (404/410), automatically removes stale tracking entry and creates a new event

### Removed

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup flow encourages one-click acceptance of defaults that include inbox-modifying behavior such as marking messages read, archiving them, and auto-processing calendar replies. Because this is presented as a recommended default without a prominent warning or explicit opt-in for each destructive action, users may unintentionally grant the skill authority to alter or discard email state they expected to review manually.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 30)May include surrounding context.

md

5. Whole-day events: Timed (9 AM - 5 PM)
6. Multi-day events: Daily recurring
7. Ignore patterns: (none)
8. Auto-create patterns: (none)
9. Email handling: Mark as read and archive (recommended)
   Also auto-process calendar replies? (Y/n)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 230)May include surrounding context.

If you prefer to skip the interactive setup:

bash

mkdir -p ~/.config/email-to-calendar
cat > ~/.config/email-to-calendar/config.json << 'EOF'
{
  "provider": "gog",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The prerequisites state that the skill can create, update, and delete calendar events, but the guide does not clearly warn users that granting this access enables destructive modifications to existing calendar data. In a calendar automation context, silent or poorly disclosed delete/update capability can lead to loss of legitimate events or unnoticed tampering if the skill misbehaves.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description advertises direct inbox monitoring and silent activity logging but does not prominently warn that the skill may scan broad unread inbox content and persist extracted information. Users may enable the skill without understanding the scope of access, creating a consent and privacy transparency gap around mailbox processing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states 'ALWAYS ASK BEFORE CREATING' but also supports 'AUTO-CREATE' behavior based on configured patterns, creating an authorization bypass in practice. This can cause calendar modifications without fresh user consent in the current conversation, which is especially risky because the skill processes potentially broad inbox content and inferred events.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to read MEMORY.md and maintain silent activity logging, while the feature list and file locations indicate persistent storage of extracted email-derived data and user preferences across sessions. Persisting mailbox-derived content and behavioral preferences increases privacy risk, retention of sensitive personal/work information, and the blast radius if local memory files are exposed or misused by other skills.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow explicitly records pending invites and extracted event details into persistent memory stores keyed by email identifiers and subjects. That creates a durable repository of communication-derived metadata that can reveal schedules, contacts, and private activities beyond the immediate task, increasing privacy exposure and secondary-use risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill automatically marks or archives emails after event creation without a prominent warning in the main description. This can alter mailbox state unexpectedly, causing users to miss messages, lose workflow cues based on unread status, or impair forensic review of what triggered calendar changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill can send outbound email notifications, which expands its capability beyond extracting events and writing calendar entries. Any compromise, prompt injection through email content, or misclassification of events with deadlines could trigger unsolicited emails, leak sensitive event details, or be abused for spam/phishing-like behavior from the user's account.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad phrases like 'check emails' and 'scan inbox' that can match common user requests and cause this skill to activate outside a narrowly scoped email-to-calendar intent. Because the skill requests read_email and calendar write capabilities, overbroad invocation increases the chance of unintended email access and event creation or modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The document explicitly instructs the script to delete an existing event or modify it as cancelled when cancellation language is detected, but it does not require any user confirmation, provenance checks, or safeguards against false positives. In an email-extraction workflow, forwarded content, quoted text, or ambiguous language could trigger unintended destructive calendar changes, causing loss of legitimate events or calendar integrity issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation includes a destructive calendar delete command with no warning, confirmation guidance, or mention of irreversibility. In an automation or agent setting, that omission increases the chance of accidental event deletion and makes it easier for downstream logic to invoke destructive actions unsafely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.