ClawHub
Back to skill

Security audit

JustCalendar

Security checks for vulnerabilities and agentic risk

Overview

This skill is straightforward JustCalendar CLI documentation with disclosed token use and Google Drive calendar changes, but users should handle install and token commands carefully.

Install only from a source and version you trust, avoid running npm commands with elevated privileges, and treat JustCalendar agent tokens like passwords. Be especially careful with bulk delete or calendar removal commands because they can change or remove Drive-backed calendar data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:31
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-49
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

bash
Global install from npm:

npm install -g justcalendar
justcalendar --help

From local project path:

cd ~/justcalendar-cli
npm install
npm install -g .
justcalendar --help

If installing from GitHub:

git clone git@github.com:AndredAlmeida/justcalendar-cli.git
cd justcalendar-cli
npm install
npm install -g .
justcalendar --help

Technical Analysis

The skill directs users to install the latest available justcalendar npm package or clone the current state of a remote GitHub repository. Neither installation method pins a reviewed version, commit hash, lockfile state, or expected integrity digest.

npm installation may execute package lifecycle scripts such as preinstall, install, and postinstall. Consequently, a compromised package release, maintainer account, transitive dependency, npm registry entry, or repository branch could execute arbitrary code during installation. A global installation increases exposure because it places executable content in globally accessible npm locations.

The audit found no evidence that the referenced package or repository is currently malicious. The vulnerability is the unsafe, mutable supply-chain installation procedure documented by the skill.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, a transitive dependency, or the referenced GitHub repository.
  2. The attacker publishes malicious package content or adds a malicious npm lifecycle script.
  3. A user or agent follows the skill and runs npm install -g justcalendar or clones the unpinned repository and runs npm install.
  4. npm retrieves the attacker-controlled version and executes its lifecycle scripts.
  5. The malicious code runs with the privileges of the user performing ...[truncated 646 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin justcalendar to a specifically reviewed version rather than installing the latest release.
  • For source installations, pin the repository to a full reviewed commit hash and verify that commit before installation.
  • Include a committed lockfile and use npm ci to enforce deterministic dependency resolution.
  • Publish and verify expected package integrity hashes or signed release provenance.
  • Review npm lifecycle scripts and dependency changes before updating the approved version.
  • Consider initially installing with lifecycle scripts disabled when compatible:
    bash
    npm ci --ignore-scripts
  • Avoid recommending elevated installation privileges.
  • Document a controlled update and re-audit process for new package versions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:68
Finding

Authentication Token Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 68; repeated at lines 102, 259, and 310
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
justcalendar login --token <YOUR_TOKEN> --url https://justcalendar.ai

The same token-passing pattern is repeated elsewhere in the document:

bash
justcalendar login --token <TOKEN> --url https://justcalendar.ai
justcalendar login --token <NEW_TOKEN> --url https://justcalendar.ai
justcalendar login --token jca_... --url https://justcalendar.ai

Technical Analysis

The documented login procedure places the agent token directly in a command-line argument. Depending on the operating system, shell, and execution environment, command arguments may be exposed through shell history, process inspection interfaces, terminal session recording, command auditing, automation logs, support bundles, or monitoring systems.

Although the document correctly says to keep tokens secret and rotate them, it does not mitigate exposure caused by the recommended command itself. The token authenticates access to a service that obtains backend-issued Google Drive access tokens and performs Drive-backed calendar operations, making disclosure security-sensitive.

Attack Path

  1. A user generates a valid JustCalendar agent token.
  2. The user follows the documented command and supplies the token through --token.
  3. The plaintext command is retained in shell history, captured by logging or monitoring, or observed through local process metadata while it is executing.
  4. An attacker with access to that record or local inspection capability extracts the token.
  5. The attacker authenticates to the JustCalendar service before the token is revoked or replaced.
  6. The attacker performs calendar operations permitted by the compromised token.

Impact Assessment

E ...[truncated 686 chars]

Remediation
View remediation

Remediation Suggestions

  • Modify the CLI to accept tokens through hidden interactive input so they are not displayed or saved in shell history.
  • Prefer reading the credential from standard input or a protected file descriptor.
  • If token files are supported, require restrictive permissions such as owner-only read and write access.
  • Avoid printing, logging, or returning the token after receipt.
  • If an environment-variable fallback is offered, clearly warn that environment variables may also be visible to child processes, diagnostics, or privileged local users.
  • Store the resulting local configuration with owner-only permissions and use an operating-system credential store where possible.
  • Add guidance for removing commands containing tokens from shell history and immediately rotating any token that may have been exposed.
  • Keep tokens short-lived and narrowly scoped, and provide explicit server-side revocation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
This skill provides complete operational guidance for `justcalendar`, a Node.js CLI that manages Just Calendar data in Google Drive through:

1. Backend-issued Google Drive access tokens from `https://justcalendar.ai`
2. Direct Google Drive API reads/writes for calendar data files

Use this skill for setup, login, troubleshooting, and day-to-day CLI operations.

Static analysis

No suspicious patterns detected.