Caldav Calendar 1.0.1
ReviewAudited by ClawScan on May 1, 2026.
Overview
This is a coherent calendar-sync helper, but users should notice that it can use calendar account credentials and create, edit, delete, and locally cache calendar events.
Before installing, make sure you are comfortable giving vdirsyncer/khal access to the selected calendar account. Prefer app-specific credentials, protect the local password file, and review any create/edit/delete actions before syncing changes.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the agent is allowed to use these commands, it may change or delete events in calendars that vdirsyncer/khal are configured to access.
The skill documents commands that can sync, create, edit, and delete calendar events. This is expected for a calendar-management tool, but these operations can alter synced calendar data.
Always sync before querying or after making changes: `vdirsyncer sync` ... `khal new ...` ... Use `khal edit`, then press `D` to delete.
Confirm which calendars are configured before using write/delete workflows, and review proposed event changes before syncing them.
The configured calendar account credentials determine what calendars the tool can read and modify.
The setup example requires a CalDAV account identity and reads a password or app token from a local file. This is purpose-aligned, but the registry metadata declares no primary credential.
username = "your@icloud.com" password.fetch = ["command", "cat", "~/.config/vdirsyncer/icloud_password"]
Use a provider-specific app password or limited-scope credential where possible, protect the password file permissions, and only configure calendars you want the agent to access.
Calendar titles, descriptions, locations, and times may be stored on disk and available to later local commands using the same account.
The skill documents persistent local storage of synced calendar .ics files and a khal cache database, which may contain private event details.
path = "~/.local/share/vdirsyncer/calendars/" fileext = ".ics" ... khal caches events in `~/.local/share/khal/khal.db`
Keep the local account secure, understand where calendar data is cached, and remove the cache or local calendar store if you no longer want the data retained.