ClawHub
Back to skill

Security audit

iCalendar Events Parser

Security checks for vulnerabilities and agentic risk

Overview

This calendar parser does what it claims, but it allows broad URL fetching and has weak local file and resource limits that users should review before installing.

Install only if you trust the calendar sources you will pass to it and are comfortable with the agent making outbound requests to arbitrary calendar URLs. Prefer local .ics files or known public calendar providers, avoid private/internal URLs, and be aware that symlinks inside the workspace may bypass the stated local-file boundary until the implementation is tightened.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
index.js:18
Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
index.js:38
Finding

Symbolic Links Can Bypass the Local File Access Boundary

Content
View full analysis
safePath === base || safePath.startsWith(base + path.sep) ); if (!isAllowed) { throw new Error( `Access restricted by iCalendar Events Parser.\n\n` + `This skill can only read files from:\n` + `• ${workspaceDir} (your current workspace)\n` + `• The skill's own folder\n\n` + `Example: "~/openclaw/workspace/my-calendar.ics" or "./my-calendar.ics"` ); } icsContent = await readFile(safePath, 'utf-8'); ``` ### Technical Analysis The access-control check is performed against the lexical path produced by `path.resolve()`. This operation normalizes path components but does not resolve symbolic links. Consequently, a symbolic link located under an authorized workspace can point to a file outside the authorized directory. The lexical path still begins with the authorized workspace prefix, so `isAllowed` evaluates to true. The subsequent `readFile()` follows the symbolic link and opens the external target. The second authorized root is also derived from `path.resolve('.')`. This represents the process's current working directory, not necessarily the skill's installation directory. If the process is launched from another directory, the implementation may authorize an unintende ...[truncated 1402 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:75
Finding

Documented Recurrence Safety Limit Is Not Enforced

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly encourages users to supply remote calendar URLs, but it does not disclose that doing so causes outbound network access and may transmit user-provided URLs or fetch data from untrusted hosts. In an agent setting, this can enable unintended requests to internal services or sensitive endpoints if a user provides a crafted URL, making the omission security-relevant rather than merely documentation-related.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill encourages fetching remote calendar URLs and explicitly asks the agent not to use an alternative fetch path, but it does not warn that using a third-party calendar URL may disclose sensitive schedule data, identifiers, locations, or embedded meeting links to remote servers. In a calendar-processing context, this omission is meaningful because .ics feeds often contain personal or organizational metadata and remote access creates a privacy and tracking risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This is a natural-language policy issue because it mandates a locale/timezone choice rather than offering user control or documenting when conversion is appropriate. Time zone is a locale-related setting, and the instruction does not present it as optional or user-confirmed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dependency uses a caret range, which permits automatic installation of newer minor/patch releases rather than an exact reviewed version. In a package that parses untrusted calendar content and may fetch remote feeds, this increases supply-chain risk because a compromised or vulnerable upstream release could be pulled in without explicit review.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
"license": "MIT",
  "homepage": "https://github.com/baptiste00001/icalendar-events-parser", 
  "dependencies": {
    "icalendar-events": "^1.1.1",
    "luxon": "^3.7.2"
  },
  "devDependencies": {}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The luxon dependency is also specified with a caret range, allowing drift from the originally tested version. While common in npm projects, this still creates a real but low-severity supply-chain exposure because future upstream releases could introduce malicious code or a breaking security issue into downstream installs.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"homepage": "https://github.com/baptiste00001/icalendar-events-parser", 
  "dependencies": {
    "icalendar-events": "^1.1.1",
    "luxon": "^3.7.2"
  },
  "devDependencies": {}
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:28