WeCom Calendar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:26 AM UTC
• Version: 1.1.0

Overview

This skill is a disclosed WeCom calendar management tool with live update and cancellation abilities that users should handle carefully, but I found no hidden execution, exfiltration, or persistence.

Install only in a workspace where WeCom calendar changes are intended, use least-privilege WeCom app permissions, keep the .env file private, verify schedule_id and cal_id values before update or cancel commands, and consider pinning dependencies with a lockfile before production use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);

// Load .env file
try {
  dotenv.config({ path: join(__dirname, '.env') });
} catch (e) {}

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

// Load .env file
try {
  dotenv.config({ path: join(__dirname, '.env') });
} catch (e) {}

const CORP_ID = process.env.WECOM_CORP_ID;

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

const data = response.data;
  if (data.errcode !== 0) {
    throw new Error(`Failed to get access token: ${data.errmsg}`);
  }
  
  return data.access_token;

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file describes capabilities to create, update, cancel, and modify calendar participants, which can directly affect user data and meeting integrity. It does not include any warning or caution that these commands will change or remove calendar entries, despite providing ready-to-run destructive examples such as cancellation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill documents cancel and delete calendar capabilities but does not clearly warn that these actions are destructive and can invalidate schedules or remove shared calendar data. In an agent-driven workflow, this increases the chance of accidental destructive operations by users or automations acting without explicit confirmation.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The example shows fetching organization member data and submitting attendee and scheduling information to WeCom APIs without any privacy, consent, or data-sharing notice. This can lead users to transfer personal or organizational data to third-party services without considering minimization, authorization, or compliance requirements.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code reads sensitive environment credentials and immediately uses them to obtain an access token over the network, but there is no user-facing warning beyond a generic header comment. The script also proceeds to send calendar data to external WeCom endpoints without confirmation or explicit disclosure that user/event information will be transmitted.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cancel operation invokes the remote WeCom schedule cancellation API immediately with no confirmation prompt, dry-run mode, or safeguard. In an agent or automation context, a mistaken invocation, malformed input, or prompt-influenced command generation could unintentionally cancel legitimate calendar events, causing integrity loss and business disruption.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: All user-facing documentation and examples are presented only in Chinese, and the file does not indicate that the skill is region-specific or provide an alternative language option. This can be a natural-language policy concern when a skill effectively forces a specific language without user opt-in.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: The script hardcodes Chinese interface text such as command descriptions and success/failure messages, which imposes a language choice on all users. There is no option to select another language or indication that the tool is intentionally limited to a Chinese-speaking audience.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"start": "node calendar.mjs"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "dotenv": "^16.3.0"
  }
}

• Confidence: 96% confidence
• Finding: The dependency uses a caret range (^1.6.0), which allows automatic installation of newer minor and patch releases. This weakens supply-chain reproducibility and can unexpectedly pull in a vulnerable or malicious upstream release, especially for a network-facing library like axios.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: The manifest references axios without pinning an exact version, and axios has multiple known advisories across releases. Because the installed version is not fixed here, it is not possible to verify from this file alone whether deployment will use a safe or vulnerable release, creating uncertainty around SSRF, MITM, or related client-side request handling issues depending on actual resolved version and usage.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "axios": "^1.6.0",
    "dotenv": "^16.3.0"
  }
}

• Confidence: 92% confidence
• Finding: The dotenv dependency is also specified with a caret range, so builds are not fully reproducible and may resolve to different versions over time. While dotenv is lower risk than a request library, unpinned dependencies still increase supply-chain exposure and make security review harder.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: calendar.mjs:21