Caldav Calendar
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only calendar skill is coherent and benign, but it can access, store, sync, and change your calendar data.
Install this only if you are comfortable letting the agent use vdirsyncer and khal with your CalDAV calendar. Protect the credential file, review commands before event changes or deletion, and remember that synced calendar data and caches remain on disk.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Mistaken or unintended use could add, modify, or delete calendar events and sync those changes to the remote calendar service.
The skill documents commands that can create, edit, delete, and then sync calendar events to a CalDAV provider. This is consistent with calendar management, but it can change user account data.
khal new 2026-01-15 10:00 11:00 "Meeting title" ... Use `khal edit`, then press `D` to delete. ... vdirsyncer sync
Use mutation commands only for explicit user-requested calendar changes, and confirm event details before creating, editing, deleting, or syncing.
Anyone or any process with access to the configured credential file may be able to access or modify the calendar account depending on provider permissions.
The setup example uses a CalDAV account credential read from a local file. Credential use is expected for CalDAV sync, but it grants calendar account access.
username = "your@icloud.com" password.fetch = ["command", "cat", "~/.config/vdirsyncer/icloud_password"]
Use provider-recommended app passwords or limited-scope tokens where available, protect the credential file with restrictive permissions, and avoid reusing account passwords.
Calendar details may persist on disk after syncing and could be exposed through local file access, backups, or stale caches.
The skill stores synced calendar content and cached event data locally. This is expected for vdirsyncer/khal, but calendar data can contain private personal or work information.
vdirsyncer syncs CalDAV calendars to local `.ics` files. ... khal caches events in `~/.local/share/khal/khal.db`
Keep the calendar directories and cache protected, review backup/sync policies for those paths, and clear the khal cache when needed.