Caldav Calendar 1.0.1

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:41 AM UTC
• Version: 1.0.0

Overview

This calendar skill is coherent and purpose-aligned, but users should protect the CalDAV password file if they follow the example setup.

Before installing, understand that this skill can help an agent read, create, edit, delete, and sync your calendar events. If you use the example password file, store only a revocable app-specific password, restrict the file to your user account, avoid backups or source control, and revoke or rotate it if exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:113

Finding

Plaintext CalDAV Credential Retrieval Without File-Permission Hardening

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 113
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: Medium

Vulnerable Code

ini

password.fetch = ["command", "cat", "~/.config/vdirsyncer/icloud_password"]

Technical Analysis

The example configuration directs vdirsyncer to execute cat and retrieve an iCloud application password from a plaintext file. The documentation does not instruct users to create the file with restrictive permissions, verify its ownership, exclude it from backups, or use protected secret storage.

The command uses a fixed executable and path, so the reviewed text does not establish a command-injection vulnerability. Transmission of the retrieved credential by vdirsyncer to the user-configured HTTPS CalDAV endpoint is also necessary for the declared calendar synchronization functionality and is not evidence of covert exfiltration. The vulnerability is the insufficiently protected at-rest credential.

Attack Path

1. A user follows the documented setup and saves an iCloud application password in ~/.config/vdirsyncer/icloud_password.
2. The file is created with permissions that permit access by another local account, or it is copied into an inadequately protected backup.
3. A local attacker, compromised process, or backup-system operator reads the plaintext credential.
4. The attacker uses the credential and associated account identifier to authenticate to the relevant CalDAV service.
5. Subject to the credential's provider-defined scope, the attacker accesses or modifies calendar information.

This path requires the credential file or a copy of it to be accessible to the attacker; the documentation alone does not grant remote access to the file.

Impact Assessment

Successful exploitation may disclose calendar metadata, event descriptions, attendees, locations, and schedules. It may also permit unauthorized event creation, modification, or deletion if the application-specif ...[truncated 426 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer retrieving the credential from an operating-system keyring or dedicated secret manager rather than a plaintext file.
2. Configure the secret-retrieval helper with a fixed executable and fixed credential identifier; do not interpolate untrusted values into shell commands.
3. If file-based storage must remain supported, document secure creation and validation:

bash

install -d -m 700 ~/.config/vdirsyncer
umask 077
printf '%s' 'APPLICATION_SPECIFIC_PASSWORD' > ~/.config/vdirsyncer/icloud_password
chmod 600 ~/.config/vdirsyncer/icloud_password

4. Require that the file be owned by the account running vdirsyncer, and advise users to reject symlinks or unexpectedly permissive files.
5. Exclude the credential file from unencrypted backups, synchronization tools, diagnostic archives, and source-control repositories.
6. Use a revocable, provider-issued application-specific password with the narrowest available scope rather than the primary account password.
7. Document credential rotation and immediate revocation procedures for suspected disclosure.
8. Retain HTTPS certificate verification for all CalDAV endpoints and direct credentials only to trusted, explicitly configured provider domains.

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

khal caches events in ~/.local/share/khal/khal.db. If data looks stale after syncing:

bash

rm ~/.local/share/khal/khal.db

Initial Setup

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown instructs users to run rm ~/.local/share/khal/khal.db, which deletes a local file, but it does not explicitly warn that this is a file deletion operation. Although the cache can likely be rebuilt, this still affects local data/state and should be disclosed in the instructions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.