OpenClaw飞书日历管理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:25 AM UTC
• Version: 1.0.0

Overview

This calendar skill is mostly coherent, but it recommends giving meeting attendees broad edit permissions by default.

Review this skill before installing if you create shared meetings. Use narrower attendee permissions where possible, confirm timezone assumptions, and require explicit confirmation before modifying events, removing attendees, or sending invitations.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:53

Finding

Overly Broad Event Modification Rights Granted to Attendees

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 53–60
Vulnerability Type: Excessive attendee permissions violating least privilege
Risk Level: Medium

Code Snippet:

text

### 2. Attendee permissions (attendee_ability)

The tool defaults to `attendee_ability: "can_modify_event"`, allowing attendees to edit events and manage participants.

| Permission value | Capability |
|------------------|------------|
| `none` | No permission |
| `can_see_others` | Can view the participant list |
| `can_invite_others` | Can invite others |
| `can_modify_event` | Can edit the event (recommended) |

The original file presents this guidance in Chinese; the excerpt above is an English translation of the complete affected segment.

Technical Analysis

The Skill states that the tool grants can_modify_event by default and recommends that permission. This gives every attendee the ability to edit the event and manage participants, even though ordinary attendance does not require either capability.

This configuration violates the principle of least privilege. Event visibility, participant-list visibility, invitation rights, and full event-modification rights are distinct authorization levels. Selecting the broadest level by default removes the organizer's opportunity to decide whether attendees should receive elevated rights.

The same insecure default is reinforced at lines 174 and 177 as the recommended solution for participant visibility and event modification issues. Participant visibility should instead be addressed with can_see_others when appropriate; it does not inherently require full modification rights.

Attack Path

1. An organizer or agent creates an event according to the Skill's guidance.
2. The calendar tool applies attendee_ability: "can_modify_event" by default.
3. One or more ordinary invitees receive event-editing and participant-management privileges without a separate auth ...[truncated 800 chars]

Remediation

View remediation

Remediation Suggestions

1. Change the default attendee_ability to none, granting ordinary attendees no event-management privileges.
2. Use can_see_others only when attendees need to view the participant list.
3. Use can_invite_others only when the organizer explicitly delegates invitation authority.
4. Require explicit, informed organizer confirmation before applying can_modify_event.
5. Clearly display which attendees will receive elevated rights and what those rights permit.
6. Update the troubleshooting guidance at lines 174 and 177 so that participant visibility does not recommend full modification rights.
7. Where the underlying API permits it, grant elevated privileges only to specifically selected trusted participants rather than all attendees.
8. Add tests or policy validation that reject broad modification permissions unless an explicit authorization flag is present.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill hard-codes Asia/Shanghai (UTC+8) as the operating timezone without indicating user choice, detection, or confirmation. For calendar and scheduling operations, timezone coercion can silently shift meeting times, causing missed meetings, incorrect invitations, and broad coordination failures affecting multiple participants.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description does not explicitly warn users that the tool can create, modify, and potentially delete calendar events or manage attendees on their behalf. In a calendar-management context, this lack of disclosure can cause users to authorize actions with real scheduling and notification consequences without informed consent, increasing the risk of unintended changes and social or operational disruption.

Content

No source excerpt is available for this finding.