Security audit

Calctl

Security checks for vulnerabilities and agentic risk

Overview

This calendar skill is coherent, but it asks users to install an unpinned external CLI and grant broad calendar access for commands that can read, create, edit, and delete events.

Review the upstream calctl project before installing, prefer a pinned and verified release if available, and revoke Calendar access when no longer needed. Be especially careful with --attendees output and with edit/delete commands because they can expose invitee information or change calendar data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:35
Finding: Unpinned Remote Executable Download and Execution
Content: View full analysis
``` ``` ### Technical Analysis The skill instructs users or agents to obtain executable code from external, mutable sources without pinning a reviewed version or commit and without verifying a cryptographic checksum or signature. The direct installation method is particularly sensitive because it downloads the asset referenced by the mutable `latest` release URL and immediately marks it executable. The Homebrew command trusts a third-party tap, while the source installation method clones the repository's current default branch. Consequently, the code executed after skill review can differ from the code that reviewers expected. HTTPS protects the download in transit but does not establish that the current upstream artifact is the same artifact previously reviewed. Compromise of the upstream repository, release workflow, maintainer account, or Homebrew tap could replace the delivered program. ### Attack Path 1. An attacker compromises or gains control of the upstream GitHub repository, release workflow, maintainer account, or third-party Homebrew tap. 2. The attacker replaces the `latest` release asset, modifies the tap formula, or changes the default branch with a malicious payload. 3. A user or agent follows one of ...[truncated 1292 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs users to grant Calendar access and can display attendee names, emails, and participation status, but it lacks a clear privacy warning that this may expose sensitive personal and third-party information. In an agent context, omission of that warning can lead to overcollection or inadvertent disclosure of calendar contents and attendee metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill exposes destructive commands such as add, edit, and delete for calendar events, but it does not explicitly warn users that these operations can modify or permanently remove personal data. Because the skill is user-invocable and targets a sensitive personal data store, a user may trigger actions without appreciating the consequences, increasing the risk of accidental data loss or unauthorized changes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.