Security audit

Apple Calendar Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Apple Calendar helper with expected calendar-modification behavior, but the package appears incomplete and should be installed only with care.

Before installing, confirm the missing add_event.scpt is supplied from a trusted source and test on a non-critical calendar. Running the add-event command may create real Calendar entries and may prompt macOS for Calendar automation permission.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code chunk’s actual function is limited to converting inputs like 'today', 'tomorrow', 'day after tomorrow', or weekday names plus HH:MM into a concrete timestamp string. This may be a supporting helper for a calendar skill, but by itself it does not implement the declared primary purpose of managing Apple Calendar events. There is no AppleScript, no access to Calendar, and no event CRUD/search behavior shown, so the supplied code does not accurately represent the declared description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill documentation does not prominently warn that running it can create or modify Apple Calendar data through AppleScript automation. Users may invoke the skill without understanding that it performs real system-side changes and may trigger macOS automation permission prompts, increasing the risk of unintended calendar modification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The usage examples directly instruct users to run osascript-based automation without an adjacent warning that macOS may request Calendar automation permissions and that executing the commands will cause real calendar changes. In agent contexts, examples are often copied verbatim, so missing safety notes can lead to unintended event creation or overbroad user consent to automation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This shell script invokes an AppleScript to add an event to the user's calendar, which modifies user data. There is no confirmation prompt, user-facing disclosure, or explanatory comment in English indicating that the script will create a calendar entry before performing the action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script's natural-language interface is inconsistent: comments state it can accept a weekday like Russian "понедельник", but the regex at L23 only accepts English weekday names. This creates a language/locale policy issue because the user-facing behavior is effectively fixed to English without offering a clear language choice or documenting the limitation consistently.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The inline comments are written in Russian, which imposes a specific language context in the skill file without any indication of user or maintainer opt-in. This can violate language or locale policy where skills are expected to avoid forcing a language unless explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The comment at L21 says RELATIVE_DATE can be a specific weekday such as the Russian example "понедельник", and L24 says the code translates it to English. However, the regex at L23 only allows English weekday names, so Russian weekday inputs never reach the translation logic and instead fail as invalid input.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.