ics to exchange-blocker

• Outcome: Pass
• Latest audit: May 29, 2026 · 8:27 PM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate calendar-sync skill that clearly discloses its Microsoft calendar write access and optional background syncing.

Install only if you are comfortable granting Microsoft calendar read/write access and storing an ICS secret URL plus OAuth tokens locally. Run a manual sync first, verify the target calendar and created blocked events, consider setting `CALINT_MS_CALENDAR_ID`, and load the launchd job only if you want continuous background syncing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly requires sensitive capabilities including environment-variable access, local file read/write, network access, and shell execution, yet no explicit permissions are declared. This creates a transparency and governance gap: users or orchestration systems may invoke a skill with broader authority than they realize, increasing the chance of unsafe execution in a credentialed environment.

Vague Triggers

Low

• Confidence: 79% confidence
• Finding: The activation guidance is broad enough that the skill could be selected for generic calendar-related requests, including contexts where the user did not intend Exchange writes or background synchronization. In a skill that can authenticate to Microsoft Graph and modify calendars, overbroad triggering increases the risk of unintended side effects.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - python3
      config:
        - ~/.calintegration/.env
    primaryEnv: CALINT_ICS_URL
    files: ["*.py", "install.sh", "requirements.txt"]
  homepage: https://github.com/Blucaru/CalIn

• Confidence: 86% confidence
• Finding: The skill is designed to read a local .env file containing a secret ICS URL and Microsoft identifiers, and its overall function also implies access to cached auth tokens. Any skill that consumes local secret material presents real credential-access risk if the skill is compromised, over-permissioned, or triggered unexpectedly, especially because ICS URLs often embed bearer-style secret tokens.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Automated Sync (macOS)

The installer generates a launchd plist for automatic sync every 5 minutes:

```bash
cd ~/.openclaw/skills/calin

• Confidence: 96% confidence
• Finding: The skill documents installation of a launchd plist to run automatically every five minutes, which is a persistence mechanism. While expected for a sync tool, persistence increases risk because the skill continues operating in the background with ongoing access to local secrets, network resources, and Exchange write permissions even after the user stops actively interacting with it.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
cd ~/.openclaw/skills/calin
bash install.sh
cp com.calintegration.sync.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.calintegration.sync.plist
```

• Confidence: 97% confidence
• Finding: Copying a plist into ~/Library/LaunchAgents establishes per-user persistence on macOS. In context this is functional rather than overtly malicious, but it still creates a durable background execution path that can repeatedly access tokens and perform calendar modifications without per-run user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

cd ~/.openclaw/skills/calin
bash install.sh
cp com.calintegration.sync.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.calintegration.sync.plist
```

## How It Works

• Confidence: 92% confidence
• Finding: The referenced plist path on the same line is part of the active persistence workflow and therefore represents a real background-execution risk. The danger is moderated by the legitimate sync use case, but persistence still broadens the blast radius if the skill, its dependencies, or stored tokens are abused.

Session Persistence

Medium

• Category: Rogue Agent

Content

cd ~/.openclaw/skills/calin
bash install.sh
cp com.calintegration.sync.plist ~/Library/LaunchAgents/
launchctl load ~/Library/LaunchAgents/com.calintegration.sync.plist
```

## How It Works

• Confidence: 92% confidence
• Finding: The referenced plist path on the same line is part of the active persistence workflow and therefore represents a real background-execution risk. The danger is moderated by the legitimate sync use case, but persistence still broadens the blast radius if the skill, its dependencies, or stored tokens are abused.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.