T06 · System Persistence
Error
- Location
SKILL.md:125- Finding
Persistent Calendar Bridge User Service
- Content
View full analysis
- Remediation
View remediation
Security audit
gcal-oauth-bridge
Security checks for vulnerabilities and agentic risk
Overview
This skill is for a real calendar-bridge workflow, but it asks users to run unpinned external code persistently with Google Calendar credentials and leaves local calendar access under-scoped.
Review before installing. Only use this if you trust and pin the external repository revision, understand the npm dependency risk, require a strong CALENDAR_BRIDGE_API_KEY, keep the service bound to localhost, and know how to disable the systemd user service and revoke Google OAuth access.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:84- Finding
Execution of Mutable External Source and Unverified npm Dependencies
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:68- Finding
Calendar Data API Permits Unauthenticated Local Access by Default
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
git clone https://github.com/DanielKillenberger/gcal-oauth-bridge.git cd gcal-oauth-bridge npm install cp .env.example .env
Edit .env with GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
git clone https://github.com/DanielKillenberger/gcal-oauth-bridge.git cd gcal-oauth-bridge npm install cp .env.example .env
Edit .env with GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET
text
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
5. Keep it running (systemd)
bash systemctl --user enable calendar-bridge.service systemctl --user start calendar-bridge.service
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The standalone trigger "google calendar" is extremely broad and can appear in ordinary conversation, general product questions, or unrelated support requests. Because no contextual constraints are attached, it risks unintended invocation of this specific self-hosted bridge skill.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The triggers "set up calendar", "calendar auth", and "calendar access" are generic and could match many unrelated calendar configuration tasks, not specifically this local Calendar Bridge service. The file does not provide exclusion conditions or tighter scoping to distinguish when this skill should activate versus other calendar or setup workflows.
- Content
Static analysis
No suspicious patterns detected.