ClawHub
Back to skill

Security audit

Caldav Cli

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward CalDAV calendar CLI guide with expected credential use, though users should be cautious about the unpinned global npm install.

Install only if you trust the `caldav-cli` npm package and are comfortable granting it access to your calendars. Prefer reviewing or pinning the package version before global installation, and grant the minimum calendar/account access you need.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:4
Finding
Unpinned Global npm Package Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 4 and 11–16 **Vulnerability Type**: Unpinned third-party dependency installed globally **Risk Level**: Medium **Vulnerable code snippets:** ```json metadata: {"clawdbot":{"emoji":"📅","os":["linux","macos"],"requires":{"bins":["caldav-cli","node"],"configs":["~/.config/caldav-cli/config.json"],"keychain":true},"install":[{"id":"npm","kind":"shell","command":"npm install -g caldav-cli","bins":["caldav-cli"],"label":"Install caldav-cli via npm"}],"source":"https://github.com/cyberash-dev/caldav-cli"}} ``` ```markdown ## Installation Requires Node.js >= 18. ```bash npm install -g caldav-cli ``` ``` ### Technical Analysis The installation command resolves the mutable latest release of `caldav-cli` from the npm registry because it does not specify an exact version. The project provides no lockfile, package integrity hash, signed artifact, or reproducible source-based installation procedure. npm packages may execute lifecycle scripts during installation. Because the command performs a global installation, a compromised package release or transitive dependency could run attacker-controlled code under the installing user's account and place or replace executables in the global npm binary location. The GitHub URL recorded in the metadata does not cryptographically establish that the npm artifact being installed was built from the referenced repository. The audited project contains only `SKILL.md`; therefore, the external package's implementation and its claims concerning keychain storage, file permissions, and credential migration cannot be verified within the available audit scope. ### Attack Path 1. An attacker compromises the npm package maintainer account, package release process, registry artifact, or a dependency used by `caldav-cli`. 2. The attacker publishes a malicious release that becomes the version selected by npm's default resolution. 3. A use ...[truncated 1281 chars]
Remediation
## Remediation Suggestions 1. Pin the dependency to a reviewed exact version, such as `caldav-cli@X.Y.Z`, rather than resolving the latest release. 2. Verify the package artifact using a documented integrity hash, trusted package signature, or signed release provenance. 3. Provide a lockfile or reproducible source-based build procedure that fixes all transitive dependency versions. 4. Confirm that the npm package identity and published artifact correspond to the referenced source repository and reviewed commit. 5. Prefer a project-local or isolated installation over a global installation where operationally feasible. 6. Audit package lifecycle scripts and install with lifecycle scripts disabled when they are not required. 7. Use automated dependency monitoring and review every version update before changing the pinned version. 8. Document minimal required permissions and test credential handling, keychain integration, configuration-file permissions, and migration behavior against the pinned implementation.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
Google requires OAuth2. Before running `caldav-cli account add`:

1. Go to https://console.cloud.google.com/
2. Create a project, enable CalDAV API
3. Create OAuth client ID (Desktop app type)
4. Note the Client ID and Client Secret
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.