yandex-calendar
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used as intended, the agent can add events to the configured calendar and sync them to Yandex.
The skill instructs the agent to run local CLI commands that can create and sync calendar events using user-provided fields. This is expected for the purpose, but it is still local command-based mutation of account data.
Выполни: `khal new "ДАТА ВРЕМЯ" "ДЛИТЕЛЬНОСТЬ" "НАЗВАНИЕ" && vdirsyncer sync`
Keep event creation user-directed, confirm ambiguous event details, and avoid unsafe shell interpolation of untrusted text.
The skill's effective permissions depend on whichever Yandex/CalDAV account and calendars are configured locally.
CalDAV synchronization through vdirsyncer/khal normally uses the user's local calendar account configuration. This is purpose-aligned, but the metadata does not declare credentials, config paths, or required binaries.
Управление Яндекс.Календарём через CalDAV (vdirsyncer + khal)
Before installing, verify khal/vdirsyncer are configured only for the calendar account and calendars you want the agent to access.
Private schedule details may become visible to the agent and appear in chat responses.
The skill retrieves calendar entries and places the results into the conversation. Calendar event titles, times, and search results can be sensitive, though this is the intended function.
→ Выполни: `vdirsyncer sync && khal list today` → Покажи результат пользователю
Use the skill only in trusted conversations and avoid exposing highly sensitive calendar entries unless needed.