Security audit

synology-calendar

Security checks for vulnerabilities and agentic risk

Overview

This Synology Calendar skill is mostly purpose-aligned, but it defaults to sending account credentials over plain HTTP and lacks adequate warnings around secrets and deletion actions.

Review this before installing. Use only an HTTPS Synology URL, prefer a dedicated low-privilege account, avoid passing the password on the command line, and be careful with delete commands because the skill can modify or remove calendar data.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: client.py:14
Finding: Credentials and Session Tokens May Be Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: client.py:265
Finding: CLI Password Argument and Authentication Identifier Logging Expose Sensitive Values
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The code substantially matches the declared Synology Calendar management purpose for calendars, events, and todos: it logs in, performs event CRUD-related operations (create/get/list/delete), task creation/listing, and calendar/timezone listing against Synology Calendar API endpoints. However, the description explicitly says it supports contacts, and there is no contact functionality in the supplied code chunk. This is a description-behavior mismatch due to an overstated supported capability. No unrelated or suspicious undeclared behaviors are present beyond standard authentication and HTTP session handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The default server URL uses plain HTTP, and the login flow sends username and password directly to that endpoint. If used on an untrusted or even moderately exposed network, credentials and session tokens can be intercepted or modified by a man-in-the-middle, leading to account compromise and unauthorized calendar access.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill documents use of environment variables and network access to authenticate to and manipulate a Synology Calendar instance, but it declares no explicit tool scope or permissions. In an agent setting, missing scope boundaries can allow broader-than-expected access to secrets and outbound connections, reducing reviewability and increasing the chance of unauthorized or surprising behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs users to place a username and password in environment variables but provides no warning about secret handling, exposure risk, shell history, process inspection, or least-privilege account usage. Because the skill authenticates to a NAS service over the network, poor credential hygiene could lead to compromise of calendar data or broader Synology account access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation advertises delete operations for calendars and events without any warning, confirmation guidance, or mention of irreversible data loss. In an agent or automation context, this increases the likelihood of accidental destructive actions against user calendar data, especially if invoked from ambiguous prompts or scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest requires a username and password for a Synology account but does not provide any user-facing warning or guidance about handling these credentials as sensitive secrets. This increases the risk that users supply long-lived admin credentials without understanding storage, logging, or least-privilege implications, which could lead to account compromise or broader NAS exposure if the skill or surrounding platform mishandles them.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code forces Asia/Shanghai as the timezone when creating non-all-day events, which imposes a locale-specific behavior without user opt-in. This can violate language/locale policy expectations because users in other regions are not given a choice or informed override path in the natural-language interface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The delete_event method issues a DELETE request that removes calendar events, and the CLI directly invokes it from the delete-event command. The code prints after deletion succeeds or fails, but there is no prior confirmation prompt, cautionary comment/docstring, or user-facing warning about the destructive action.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: For timed tasks, the code assigns Asia/Shanghai as the timezone automatically, which enforces a region-specific locale setting. The file does not present this as an opt-in choice or clearly justify the restriction as region-specific behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: When due is passed as a non-string integer, the task code sets tz_id to Asia/Shanghai, again enforcing a locale-specific default. Because users are not offered a timezone choice, this is a natural-language policy concern around locale handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation presents Asia/Shanghai as the timezone example for event creation and uses it directly in the sample call, without noting that users should choose a timezone appropriate to their locale. This can be interpreted as a locale-specific default embedded in the skill instructions without opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description states the skill supports calendars, events, todos, and contacts. In this file, the implemented API methods cover login/logout, event management, task management, calendar listing, and timezone listing, but there are no contact endpoints, methods, or CLI commands.
Content: No source excerpt is available for this finding.