temporal-cortex-scheduling

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:41 AM UTC
• Version: 0.9.1

Overview

This scheduling skill is mostly transparent and purpose-aligned, but it asks users to run calendar-authentication code from npm and a downloaded native binary that will handle OAuth tokens and calendar writes.

Install only if you are comfortable granting this MCP server access to your calendar providers and local OAuth tokens. Prefer pinned commands such as @temporal-cortex/cortex-mcp@0.9.1 for authentication, verify the GitHub release checksums before first use, and use Docker containment for higher assurance. Treat credentials.json as sensitive secret material and confirm every booking before allowing the write tools to run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:18

Finding

Unreviewed Remote Native Binary Downloaded and Executed Through an npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-44
Vulnerability Type: T03: Remote Payload Retrieval and Execution, T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet

yaml

metadata:
  author: temporal-cortex
  version: "0.9.1"
  mcp-server: "@temporal-cortex/cortex-mcp"
  homepage: "https://temporal-cortex.com"
  repository: "https://github.com/temporal-cortex/skills"
  openclaw:
    install:
      - kind: node
        package: "@temporal-cortex/cortex-mcp@0.9.1"
        bins: [cortex-mcp]
    requires:
      bins:
        - npx
      config:
        - ~/.config/temporal-cortex/credentials.json
        - ~/.config/temporal-cortex/config.json

text

**Install and startup lifecycle:**
1. `npx` resolves `@temporal-cortex/cortex-mcp` from the npm registry (one-time, cached locally after first download)
2. The postinstall script downloads the platform-specific binary from the [GitHub Release](https://github.com/temporal-cortex/mcp/releases/tag/mcp-v0.9.1) and verifies its SHA256 checksum against the embedded `checksums.json` — **installation halts on mismatch**
3. The MCP server starts as a local process communicating over stdio (no listening ports)
4. Calendar tools make authenticated API calls to your configured providers (Google Calendar API, Microsoft Graph API, CalDAV endpoints)

Technical Analysis

The Skill does not contain the implementation of its MCP server. Instead, it directs the runtime to install an npm package whose postinstall lifecycle downloads a platform-specific native executable from a remote GitHub release. The resulting executable therefore lies outside the reviewed project artifact and can execute with the privileges of the user running the Skill.

Version 0.9.1 is pinned in the installation metadata, which limits ordinary dependency drift. However, the documented authentication commands in `references/MULTI-CA ...[truncated 3295 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every documented invocation to the reviewed package version, for example:

   bash

   npx @temporal-cortex/cortex-mcp@0.9.1 auth google
   

2. Avoid downloading executable content during postinstall. Distribute a reviewed binary as an integrity-addressed package artifact, or build it locally from a pinned source commit.

3. Require signature verification or a hard-coded SHA-256 digest obtained through an independent trust channel. Do not rely solely on checksums embedded in the package that performs the download.

4. Publish provenance attestations, signed release metadata, and reproducible-build instructions that bind the source commit, npm package, and native binaries together.

5. Make verification mandatory before execution rather than presenting it only as an optional pre-run recommendation.

6. Prefer a digest-pinned container image and run it with:

   • A read-only root filesystem
   • No privileged mode
   • Dropped Linux capabilities
   • A narrowly scoped, read-only credential mount where feasible
   • Explicit network allowlisting for required calendar providers
   • No access to unrelated host files or sockets

7. Apply restrictive filesystem permissions to credential files and store refresh tokens in an operating-system credential manager where supported.

8. Disable npm lifecycle scripts during package inspection, review the package contents, and only permit the required installer after artifact verification.

9. Include the installer and relevant runtime source in the audited project or perform a separate security review of the exact npm package, native binary, and release workflow before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

bins:
        - npx
      config:
        - ~/.config/temporal-cortex/credentials.json
        - ~/.config/temporal-cortex/config.json
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

bins:
        - npx
      config:
        - ~/.config/temporal-cortex/credentials.json
        - ~/.config/temporal-cortex/config.json
---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/MULTI-CALENDAR.md (reported line 87)May include surrounding context.

md

bins:
        - npx
      config:
        - ~/.config/temporal-cortex/credentials.json
        - ~/.config/temporal-cortex/config.json
---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

# Calendar Scheduling & Booking

14 tools (Layers 0, 2–4) for contact resolution, calendar discovery, event querying, free slot finding, availability checking, RRULE expansion, atomic booking, Open Scheduling, and proposal composition. 12 read-only tools + 2 write tools (`book_slot`, `request_booking`).

## Source & Provenance

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documented auth command uses npx @temporal-cortex/cortex-mcp auth google without an explicit version pin, which can cause users to execute the latest registry version rather than the reviewed 0.9.1 release. If the package is updated maliciously or compromised upstream, this creates a supply-chain execution path with access to local OAuth setup and calendar-related credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly states that most tools make external API calls to calendar providers, but it does not warn users that calendar identifiers, time windows, and potentially sensitive scheduling metadata will be transmitted to third-party services. In a scheduling skill, this omission can mislead users into sharing availability and event-related data without clear notice, creating privacy and compliance risk even if the tools are read-only.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The documentation instructs users to run npx @temporal-cortex/cortex-mcp auth google without pinning an exact package version. This allows whatever version is currently published under that package name to be fetched and executed, creating a supply-chain risk if a malicious or compromised release is published later.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This example uses npx @temporal-cortex/cortex-mcp auth outlook without a pinned version, which can cause users to execute an unreviewed latest package from the registry. In security-sensitive tooling that handles calendar and OAuth authentication, that creates meaningful remote code execution and credential theft risk through package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The CalDAV auth command likewise invokes an unpinned npm package through npx, causing dynamic retrieval and execution of the latest published code. Because this tool handles authentication setup and likely receives credentials or tokens, a compromised package version could directly expose sensitive account access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file states that credentials are stored in ~/.config/temporal-cortex/credentials.json but gives no warning that this file contains sensitive authentication material. Users may incorrectly assume ordinary configuration handling is sufficient, increasing the chance of accidental disclosure through backups, source control, shared machines, or weak filesystem permissions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file documents behaviors that process personal data: finding people, checking their availability, and booking meetings, and later explicitly references email addresses and phone numbers. Under the markdown-file criteria, the description should warn users about privacy-sensitive handling of contact data and calendar actions, but no such warning is present.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/TEMPORAL-LINKS.md (reported line 27)May include surrounding context.

Retrieve free time slots for a given date.

bash

curl "https://book.temporal-cortex.com/public/jane-doe/availability?date=2026-03-10"

With optional parameters:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation normalizes collecting and transmitting attendee email addresses to a public unauthenticated booking endpoint without any privacy notice, consent guidance, or data-minimization warning. In a scheduling skill, this can lead agents or integrators to send third-party personal data to an external service by default, creating privacy, compliance, and user-expectation risks even if the behavior is functionally required for booking.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.