Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed WeCom calendar management tool with live update and cancellation abilities that users should handle carefully, but I found no hidden execution, exfiltration, or persistence.
Install only in a workspace where WeCom calendar changes are intended, use least-privilege WeCom app permissions, keep the .env file private, verify schedule_id and cal_id values before update or cancel commands, and consider pinning dependencies with a lockfile before production use.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
// Load .env file
try {
dotenv.config({ path: join(__dirname, '.env') });
} catch (e) {}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Load .env file
try {
dotenv.config({ path: join(__dirname, '.env') });
} catch (e) {}
const CORP_ID = process.env.WECOM_CORP_ID;
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const data = response.data;
if (data.errcode !== 0) {
throw new Error(`Failed to get access token: ${data.errmsg}`);
}
return data.access_token;
This markdown file describes capabilities to create, update, cancel, and modify calendar participants, which can directly affect user data and meeting integrity. It does not include any warning or caution that these commands will change or remove calendar entries, despite providing ready-to-run destructive examples such as cancellation.
The skill documents cancel and delete calendar capabilities but does not clearly warn that these actions are destructive and can invalidate schedules or remove shared calendar data. In an agent-driven workflow, this increases the chance of accidental destructive operations by users or automations acting without explicit confirmation.
The example shows fetching organization member data and submitting attendee and scheduling information to WeCom APIs without any privacy, consent, or data-sharing notice. This can lead users to transfer personal or organizational data to third-party services without considering minimization, authorization, or compliance requirements.
This code reads sensitive environment credentials and immediately uses them to obtain an access token over the network, but there is no user-facing warning beyond a generic header comment. The script also proceeds to send calendar data to external WeCom endpoints without confirmation or explicit disclosure that user/event information will be transmitted.
The cancel operation invokes the remote WeCom schedule cancellation API immediately with no confirmation prompt, dry-run mode, or safeguard. In an agent or automation context, a mistaken invocation, malformed input, or prompt-influenced command generation could unintentionally cancel legitimate calendar events, causing integrity loss and business disruption.
All user-facing documentation and examples are presented only in Chinese, and the file does not indicate that the skill is region-specific or provide an alternative language option. This can be a natural-language policy concern when a skill effectively forces a specific language without user opt-in.
The script hardcodes Chinese interface text such as command descriptions and success/failure messages, which imposes a language choice on all users. There is no option to select another language or indication that the tool is intentionally limited to a Chinese-speaking audience.
The dependency uses a caret range (^1.6.0), which allows automatic installation of newer minor and patch releases. This weakens supply-chain reproducibility and can unexpectedly pull in a vulnerable or malicious upstream release, especially for a network-facing library like axios.
"start": "node calendar.mjs"
},
"dependencies": {
"axios": "^1.6.0",
"dotenv": "^16.3.0"
}
}
The manifest references axios without pinning an exact version, and axios has multiple known advisories across releases. Because the installed version is not fixed here, it is not possible to verify from this file alone whether deployment will use a safe or vulnerable release, creating uncertainty around SSRF, MITM, or related client-side request handling issues depending on actual resolved version and usage.
The dotenv dependency is also specified with a caret range, so builds are not fully reproducible and may resolve to different versions over time. While dotenv is lower risk than a request library, unpinned dependencies still increase supply-chain exposure and make security review harder.
},
"dependencies": {
"axios": "^1.6.0",
"dotenv": "^16.3.0"
}
}