ClawHub
Back to skill

Security audit

yandex-calendar

Security checks for vulnerabilities and agentic risk

Overview

This calendar skill is purpose-aligned, but it tells agents to run user-derived shell commands that can modify and sync a remote calendar without a confirmation step.

Review this skill before installing. It should be limited to a trusted local environment with khal and vdirsyncer already configured, and agents should confirm event details before creating or syncing anything. Do not pass untrusted event names or search text into the shown shell templates unless the agent/tool invokes commands with separate literal arguments or applies robust escaping.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:14
Finding

Shell Command Injection Through Unsanitized Calendar Input

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14, 23, 38, and 42
Vulnerability Type: Shell command injection caused by unsafe interpolation of user-controlled values
Risk Level: High

The skill instructs the agent to insert user-provided dates, durations, event names, and search terms directly into shell command templates:

bash
khal new "ДАТА ВРЕМЯ" "ДЛИТЕЛЬНОСТЬ" "НАЗВАНИЕ" && vdirsyncer sync
bash
khal search "текст для поиска"

The same unsafe command construction is repeated in the bot instructions:

text
**"Добавь встречу [дата] в [время]"**
→ Выполни: `khal new "ДАТА ВРЕМЯ" "ДЛИТЕЛЬНОСТЬ" "НАЗВАНИЕ" && vdirsyncer sync`
→ Примеры дат: "завтра 15:00", "2026-02-10 14:00"

**"Найди событие про [тема]"**
→ Выполни: `khal search "тема"`

Technical Analysis

Shell double quotes do not make arbitrary input safe. Command substitutions such as $(command) and backtick substitutions may still be evaluated inside double-quoted strings. An attacker may also inject a double quote followed by shell operators to terminate the intended argument and introduce an additional command.

For example, if a malicious event title is substituted into the documented template as:

text
$(id)

the resulting shell command may evaluate id before invoking khal. A payload that closes the quote and introduces shell operators could similarly execute an independent command. Search terms are exposed to the same issue.

Exploitation depends on the agent constructing a command string from the template and executing it through a shell. The skill provides no validation, escaping, argument-array invocation requirement, or rejection rules for shell metacharacters.

Attack Path

  1. An attacker asks the agent to create or search for a calendar event containing a crafted title, date, duration, or search term.
  2. The agent places the attacker-controlled text into on ...[truncated 1121 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not build shell command strings by concatenating or interpolating user input.
  2. Invoke khal and vdirsyncer through an API that accepts an executable and a separate argument array, with shell processing disabled.
  3. Validate dates and times against strict accepted formats and parse them before invocation.
  4. Restrict durations to an allowlist or a strict pattern such as positive integers followed by an approved unit.
  5. Pass event titles and search terms as literal arguments. Do not attempt to rely solely on shell quoting.
  6. If a shell is unavoidable, apply a well-tested shell-escaping library to every dynamic argument and reject control characters, command substitutions, quote-breaking input, and shell operators.
  7. Require explicit user confirmation before creating or modifying calendar events.
  8. Execute calendar operations under a least-privileged account with access only to the required calendar configuration and data.
  9. Update the skill instructions to prescribe safe structured tool invocation rather than executable command templates containing placeholders.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to create calendar events and immediately sync them to a remote CalDAV service without requiring an explicit user confirmation or warning that state will be modified. This creates a real risk of unintended calendar changes, especially if the agent misparses date, time, duration, or title from natural-language requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language instructions, trigger examples, and command usage guidance are all presented only in Russian, and the bot instructions assume Russian user phrasing. There is no indication that the skill is region-specific or that users may opt into another language, which can violate a language/locale policy requiring choice or justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.