yandex-calendar

• Outcome: Pass
• Latest audit: May 28, 2026, 9:36 AM
• Version:
  1.0.0

Overview

This skill is a straightforward Yandex Calendar helper, with normal privacy and accidental-change risks from reading, adding, and syncing calendar events.

Install this only if you want the agent to use your existing khal/vdirsyncer calendar setup. Review ambiguous event details before allowing additions, and make sure the configured calendars are ones you are comfortable letting the agent read and sync.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase is broad enough that a variety of ordinary calendar-related questions could cause the agent to execute shell commands without clearly establishing user intent, scope, or safety constraints. In a skill that can both read and modify calendar data, ambiguous activation increases the risk of unintended command execution or acting on loosely parsed natural-language input.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to run a calendar-modifying command directly from a natural-language request without any confirmation, preview, or validation step. This can lead to accidental creation of incorrect events, especially when dates, times, titles, or durations are inferred from ambiguous user phrasing.

VirusTotal

63/63 vendors flagged this skill as clean.