JustCalendar

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:11 AM UTC
• Version: 1.0.2

Overview

This skill is straightforward JustCalendar CLI documentation with disclosed token use and Google Drive calendar changes, but users should handle install and token commands carefully.

Install only from a source and version you trust, avoid running npm commands with elevated privileges, and treat JustCalendar agent tokens like passwords. Be especially careful with bulk delete or calendar removal commands because they can change or remove Drive-backed calendar data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31
• Finding: Unpinned Third-Party Package Installation Creates Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 31-49 **Vulnerability Type**: Unverified and unpinned third-party dependencies **Risk Level**: Medium ### Vulnerable Code ```bash Global install from npm: npm install -g justcalendar justcalendar --help From local project path: cd ~/justcalendar-cli npm install npm install -g . justcalendar --help If installing from GitHub: git clone [e-mail]:AndredAlmeida/justcalendar-cli.git cd justcalendar-cli npm install npm install -g . justcalendar --help ``` ### Technical Analysis The skill directs users to install the latest available `justcalendar` npm package or clone the current state of a remote GitHub repository. Neither installation method pins a reviewed version, commit hash, lockfile state, or expected integrity digest. npm installation may execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Consequently, a compromised package release, maintainer account, transitive dependency, npm registry entry, or repository branch could execute arbitrary code during installation. A global installation increases exposure because it places executable content in globally accessible npm locations. The audit found no evidence that the referenced package or repository is currently malicious. The vulnerability is the unsafe, mutable supply-chain installation procedure documented by the skill. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or the referenced GitHub repository. 2. The attacker publishes malicious package content or adds a malicious npm lifecycle script. 3. A user or agent follows the skill and runs `npm install -g justcalendar` or clones the unpinned repository and runs `npm install`. 4. npm retrieves the attacker-controlled version and executes its lifecycle scripts. 5. The malicious code runs with the privileges of the user performing ...[truncated 646 chars]
• Remediation: ## Remediation Suggestions - Pin `justcalendar` to a specifically reviewed version rather than installing the latest release. - For source installations, pin the repository to a full reviewed commit hash and verify that commit before installation. - Include a committed lockfile and use `npm ci` to enforce deterministic dependency resolution. - Publish and verify expected package integrity hashes or signed release provenance. - Review npm lifecycle scripts and dependency changes before updating the approved version. - Consider initially installing with lifecycle scripts disabled when compatible: ```bash npm ci --ignore-scripts ``` - Avoid recommending elevated installation privileges. - Document a controlled update and re-audit process for new package versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68
• Finding: Authentication Token Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `SKILL.md`, line 68; repeated at lines 102, 259, and 310 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```bash justcalendar login --token <YOUR_TOKEN> --url https://justcalendar.ai ``` The same token-passing pattern is repeated elsewhere in the document: ```bash justcalendar login --token <TOKEN> --url https://justcalendar.ai justcalendar login --token <NEW_TOKEN> --url https://justcalendar.ai justcalendar login --token jca_... --url https://justcalendar.ai ``` ### Technical Analysis The documented login procedure places the agent token directly in a command-line argument. Depending on the operating system, shell, and execution environment, command arguments may be exposed through shell history, process inspection interfaces, terminal session recording, command auditing, automation logs, support bundles, or monitoring systems. Although the document correctly says to keep tokens secret and rotate them, it does not mitigate exposure caused by the recommended command itself. The token authenticates access to a service that obtains backend-issued Google Drive access tokens and performs Drive-backed calendar operations, making disclosure security-sensitive. ### Attack Path 1. A user generates a valid JustCalendar agent token. 2. The user follows the documented command and supplies the token through `--token`. 3. The plaintext command is retained in shell history, captured by logging or monitoring, or observed through local process metadata while it is executing. 4. An attacker with access to that record or local inspection capability extracts the token. 5. The attacker authenticates to the JustCalendar service before the token is revoked or replaced. 6. The attacker performs calendar operations permitted by the compromised token. ### Impact Assessment E ...[truncated 686 chars]
• Remediation: ## Remediation Suggestions - Modify the CLI to accept tokens through hidden interactive input so they are not displayed or saved in shell history. - Prefer reading the credential from standard input or a protected file descriptor. - If token files are supported, require restrictive permissions such as owner-only read and write access. - Avoid printing, logging, or returning the token after receipt. - If an environment-variable fallback is offered, clearly warn that environment variables may also be visible to child processes, diagnostics, or privileged local users. - Store the resulting local configuration with owner-only permissions and use an operating-system credential store where possible. - Add guidance for removing commands containing tokens from shell history and immediately rotating any token that may have been exposed. - Keep tokens short-lived and narrowly scoped, and provide explicit server-side revocation.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation

Content

This skill provides complete operational guidance for `justcalendar`, a Node.js CLI that manages Just Calendar data in Google Drive through:

1. Backend-issued Google Drive access tokens from `https://justcalendar.ai`
2. Direct Google Drive API reads/writes for calendar data files

Use this skill for setup, login, troubleshooting, and day-to-day CLI operations.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.