yandex-calendar

PassAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward instruction-only calendar skill, but it relies on local khal/vdirsyncer access to read and create Yandex calendar events.

This skill appears coherent and purpose-aligned. Install it only if you are comfortable with the agent using your local khal/vdirsyncer setup to view, search, add, and sync Yandex Calendar events.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If used as intended, the agent can add events to the configured calendar and sync them to Yandex.

Why it was flagged

The skill instructs the agent to run local CLI commands that can create and sync calendar events using user-provided fields. This is expected for the purpose, but it is still local command-based mutation of account data.

Skill content
Выполни: `khal new "ДАТА ВРЕМЯ" "ДЛИТЕЛЬНОСТЬ" "НАЗВАНИЕ" && vdirsyncer sync`
Recommendation

Keep event creation user-directed, confirm ambiguous event details, and avoid unsafe shell interpolation of untrusted text.

What this means

The skill's effective permissions depend on whichever Yandex/CalDAV account and calendars are configured locally.

Why it was flagged

CalDAV synchronization through vdirsyncer/khal normally uses the user's local calendar account configuration. This is purpose-aligned, but the metadata does not declare credentials, config paths, or required binaries.

Skill content
Управление Яндекс.Календарём через CalDAV (vdirsyncer + khal)
Recommendation

Before installing, verify khal/vdirsyncer are configured only for the calendar account and calendars you want the agent to access.

What this means

Private schedule details may become visible to the agent and appear in chat responses.

Why it was flagged

The skill retrieves calendar entries and places the results into the conversation. Calendar event titles, times, and search results can be sensitive, though this is the intended function.

Skill content
→ Выполни: `vdirsyncer sync && khal list today`
→ Покажи результат пользователю
Recommendation

Use the skill only in trusted conversations and avoid exposing highly sensitive calendar entries unless needed.