Calendly Quick Book

Book Calendly meetings instantly. Triggers on "book", "schedule calendly", "calendly book", or any request to book a meeting without sending a link.

Security Scan

Skill appears to do what it says (uses Calendly API and only asks for a Calendly token), but the always: true setting and lack of explicit confirmation/consent steps create meaningful risk of unintended autonomous bookings or token misuse.

Purpose & Capability

The skill's name/description (book Calendly meetings) matches the declared requirement (CALENDLY_API_TOKEN) and the SKILL.md shows direct Calendly API calls (users/me, event_types, available times, invitees). Asking for a Calendly API token is appropriate for the stated purpose.

Instruction Scope

Instructions are narrowly focused on Calendly API calls via curl and include timezone mapping and booking flow; they do not instruct reading unrelated files or environment variables. However, the SKILL.md shows no explicit user-confirmation step before creating bookings, which means an agent using the skill could create meetings autonomously without a clear consent/confirmation step.

Install Mechanism

Instruction-only skill with no install spec or downloaded code — minimal disk write/execution risk. The README suggests copying the skill and setting env vars, which is standard for instruction-only skills.

Credentials

Only CALENDLY_API_TOKEN is required, which is proportional for making API calls. Minor inconsistency: metadata lists the env var but 'Primary credential' is unset; not a functional problem but could be clarified. Because the skill can act autonomously (see persistence_privilege), granting a long-lived personal access token increases exposure — use a token with limited scope or rotate it if installed.

Persistence & Privilege

The skill sets always: true (force-included in every agent run). That is a significant privilege: it will be present/eligible for invocation on all agent interactions and bypasses some eligibility gates. Combined with the ability to create bookings via the provided token and the lack of an explicit confirmation step, this increases the risk of unwanted or accidental bookings and token misuse.

What to consider before installing

This skill otherwise looks coherent (it only needs CALENDLY_API_TOKEN and uses Calendly API endpoints), but the always: true flag is the main red flag — it forces the skill to be loaded for every agent run and increases the chance the agent will create bookings autonomously. Before installing: - Remove or question the always: true setting; prefer opt-in/autonomous invocation instead of forced inclusion. - Ensure the token is a least-privilege Calendly token (scoped/short-lived if possible) and rotate it after testing. - Modify the skill (or request the author change it) to require explicit user confirmation before creating any booking (show proposed date/time and ask 'Confirm?'). - Verify who published the skill (source/homepage is unknown); prefer skills from known authors or with a homepage/repo so you can inspect updates. If you want lower risk, do not install while always: true is set; or install but keep the CALENDLY_API_TOKEN unset until you review or modify the SKILL.md to add confirmation and to remove always: true.

Book Calendly meetings via natural language. No tab switching, no link sending.

Default Configuration

Setting	Value
Default Calendly Link	https://calendly.com/YOUR_USERNAME
Calendly Username	YOUR_USERNAME

Note: Update the values above with your own Calendly username after installation.

Commands

Input	Action
book [name] [email] [timezone] [time]	Book a meeting
calendly book [name] [email] [timezone] [time]	Book a meeting

Input Fields

Field	Required	Example
Name	Yes	John Smith
Email	Yes	[e-mail]
Timezone	Yes	EST, PST, UTC
Time	Yes	tomorrow 2pm

Timezone Mapping

Input	IANA Format
EST/EDT	America/New_York
CST/CDT	America/Chicago
MST/MDT	America/Denver
PST/PDT	America/Los_Angeles
GMT/UTC	UTC

API Workflow

Step 1: Get Current User

curl -s "https://api.calendly.com/users/me" \
  -H "Authorization: Bearer $CALENDLY_API_TOKEN"

Step 2: Get Event Types

curl -s "https://api.calendly.com/event_types?user={USER_URI}" \
  -H "Authorization: Bearer $CALENDLY_API_TOKEN"

Step 3: Get Available Times

curl -s "https://api.calendly.com/event_type_available_times?event_type={EVENT_TYPE_URI}&start_time={START_UTC}&end_time={END_UTC}" \
  -H "Authorization: Bearer $CALENDLY_API_TOKEN"

Step 4: Create Booking

curl -s -X POST "https://api.calendly.com/invitees" \
  -H "Authorization: Bearer $CALENDLY_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "{EVENT_TYPE_URI}",
    "start_time": "{TIME_UTC}",
    "invitee": {
      "name": "{NAME}",
      "email": "{EMAIL}",
      "timezone": "{TIMEZONE_IANA}"
    }
  }'

Response Format

Success

✅ Meeting Booked!

📅 [Date]
⏰ [Time] [Timezone]
👤 [Name] ([Email])
📍 Calendar invite sent automatically

No Availability

⚠️ No availability at [time]

Nearest slots:
1. [Option 1]
2. [Option 2]
3. [Option 3]

Errors

Error	Response
Invalid email	Ask to confirm email
Token expired	Direct to Calendly settings
No event types	Direct to create one in Calendly