Caldav Cli

Manage CalDAV calendars (iCloud, Google, Yandex) from the command line. Supports OAuth2 and Basic auth, multi-account, table/JSON output.

Security Scan

The skill's stated purpose (a CLI wrapper for caldav-cli) matches the binaries, config path, and keychain usage described in the instructions; nothing requested appears disproportionate, though you should still review the npm package and consent flows before installing.

Purpose & Capability

The skill is an instruction-only wrapper for the caldav-cli Node package. Requiring the caldav-cli binary and Node.js and using ~/.config/caldav-cli/config.json and the OS keychain are consistent with the described CalDAV calendar management and OAuth2/basic auth workflows.

Instruction Scope

SKILL.md contains only expected usage and installation instructions (npm install, account add/list/remove, events list/create). It instructs the user to provide credentials via an interactive wizard and to store secrets in the OS keychain; it does not instruct reading unrelated files or exfiltrating data.

Install Mechanism

Installation is via npm (npm install -g caldav-cli) with an indicated GitHub source. npm installs are normal for Node CLIs but carry the usual supply-chain risk — review the package and its repo before installing. No obscure download URLs or archive extraction are used.

Credentials

No environment variables or unrelated credentials are requested. The skill legitimately needs user-supplied app-specific passwords or OAuth client credentials for providers; these are documented as being stored in the OS keychain rather than plaintext on disk.

Persistence & Privilege

The skill does not request always: true and does not modify other skills or system-wide agent settings. It persists only a config file (~/.config/caldav-cli/config.json) and stores secrets in the OS keychain, which is appropriate for a calendar client. Note: the agent is allowed to invoke the skill autonomously by default — expected behavior but be aware it could access calendars if credentials are present.

Assessment

This skill appears coherent with its stated purpose, but take precautions before installing: 1) Verify the npm package and GitHub repo (typosquat or malicious packages are possible). 2) Inspect the caldav-cli code or its README if you can, and confirm the package author and recent release history. 3) Be mindful when providing OAuth client secrets or app-specific passwords — although the tool claims to store secrets in the OS keychain, review config.json after first run to confirm secrets are not written to disk. 4) If you allow autonomous agent invocation, remember the agent could run caldav-cli commands with any stored credentials and access your calendar data. If you are unsure, install and test the package locally in a controlled environment first or run the CLI manually instead of granting an agent automatic access.

A CalDAV CLI client. Manages multiple accounts with secure OS keychain storage. Supports iCloud, Google (OAuth2), Yandex and any custom CalDAV server.

Installation

Requires Node.js >= 18.

npm install -g caldav-cli

After installation the caldav-cli command is available globally.

Quick Start

caldav-cli account add          # Interactive wizard: pick provider, enter credentials
caldav-cli events list          # Show events for the next 7 days
caldav-cli events create        # Interactive wizard: create a new event

Account Management

Add account (interactive wizard — prompts for provider, credentials, tests connection):

caldav-cli account add

List configured accounts:

caldav-cli account list

Remove an account:

caldav-cli account remove <name>

View Events

caldav-cli events list                           # Next 7 days (default)
caldav-cli events list --from 2026-02-10 --to 2026-02-20
caldav-cli events list -a work                   # Specific account
caldav-cli events list -c "Team Calendar"        # Filter by calendar name
caldav-cli events list -a work -c Personal --from 2026-03-01 --to 2026-03-31

JSON output (for scripting):

caldav-cli events list --json
caldav-cli events list --json --from 2026-02-10 --to 2026-02-20

Create Events

Interactive wizard (prompts for all fields):

caldav-cli events create

Non-interactive (all options via flags):

caldav-cli events create \
  --title "Team standup" \
  --start "2026-02-10T10:00" \
  --end "2026-02-10T10:30" \
  --account work \
  --calendar "Team Calendar" \
  --description "Daily sync" \
  --location "Room 42"

Partial flags (wizard prompts for the rest):

caldav-cli events create --title "Lunch" --account work

JSON output after creation:

caldav-cli events create --json --title "Event" --start "2026-02-10T10:00" --end "2026-02-10T11:00"

Supported Providers

Provider	Auth	Server URL
Apple iCloud	Basic (app-specific password)	https://caldav.icloud.com
Google Calendar	OAuth2 (Client ID + Secret)	https://apidata.googleusercontent.com/caldav/v2
Yandex Calendar	Basic (app password)	https://caldav.yandex.ru
Custom	Basic	User provides URL

Google Calendar Setup

Google requires OAuth2. Before running caldav-cli account add:

1. Go to https://console.cloud.google.com/
2. Create a project, enable CalDAV API
3. Create OAuth client ID (Desktop app type)
4. Note the Client ID and Client Secret

The wizard will ask for these, then open a browser for authorization. The refresh token is stored securely in the OS keychain.

Data Storage

• Passwords, OAuth2 refresh tokens, and OAuth2 client credentials (Client ID, Client Secret, Token URL): OS keychain (macOS Keychain, Linux libsecret, Windows Credential Vault) via @napi-rs/keyring. Never written to disk in plaintext.
• Account metadata (name, provider ID, username, server URL): ~/.config/caldav-cli/config.json (file permissions 0600).

No secrets are stored on disk. Existing installations that stored OAuth2 client credentials in config.json are automatically migrated to the keychain on first run.

Flag Reference

events list

Flag	Short	Description	Default
--account <name>	-a	Account name	default account
--from <date>		Start date (YYYY-MM-DD)	today
--to <date>		End date (YYYY-MM-DD)	today + 7 days
--calendar <name>	-c	Filter by calendar name	all calendars
--json		Output as JSON	false

events create

Flag	Short	Description
--title <title>	-t	Event title
--start <datetime>	-s	Start (YYYY-MM-DDTHH:mm)
--end <datetime>	-e	End (YYYY-MM-DDTHH:mm)
--account <name>	-a	Account name
--calendar <name>	-c	Calendar name
--description <text>	-d	Event description
--location <text>	-l	Event location
--json		Output as JSON

All events create flags are optional. Omitted values trigger interactive prompts.