gcal-pro - Google Calendar

• Analyzed: May 12, 2026, 3:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 132eebe96c6ae31255a03da1607e15e6b55dd21008cb721765ef75091e0ac9d8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills bundle for 'gcal-pro' is classified as benign. The skill's code (`gcal_auth.py`, `gcal_core.py`, `gcal_license.py`) and documentation (`SKILL.md`, `README.md`, `docs/GOOGLE_CLOUD_SETUP.md`) consistently describe and implement a Google Calendar integration. There is no evidence of data exfiltration, malicious execution (e.g., `curl|bash`, `eval`/`exec` of untrusted input), persistence mechanisms beyond a user-configured cron for morning briefs, or prompt injection attempts against the agent. Sensitive files like `client_secret.json` and `token.json` are handled securely in `~/.config/gcal-pro/` with appropriate file permissions (`0o600`). All network calls are to legitimate Google OAuth and Calendar API endpoints, and requested scopes are appropriate for calendar management.