ClawHub
Back to skill

Security audit

yandex-calendar

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward calendar helper, with normal privacy and accidental-change risks from reading, adding, and syncing calendar events.

Install this only if you want the agent to use your existing khal/vdirsyncer calendar setup. Before allowing event additions, review ambiguous dates, times, durations, and titles, and make sure the configured calendars are ones you are comfortable letting the agent read and sync.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to perform a write action that modifies the user's calendar immediately, without requiring an explicit confirmation step or showing the parsed event details first. This creates a real risk of unintended calendar changes from ambiguous natural-language input, misparsed dates/times, or prompt-triggered actions that the user did not mean to authorize.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.