cal-candy: a Markdown calendar

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward local Markdown calendar, but it can persist, modify, and delete local calendar files, so users should review the storage path and deletion behavior.

This skill is reasonable for managing a local Markdown calendar. Before installing, check that you are comfortable with it writing to ~/.openclaw/workspace/calendar or your MDCAL_DIR path, and ask the agent to show event IDs before deleting anything.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken event ID or overly broad agent instruction could remove a local calendar entry.

Why it was flagged

The skill exposes a deletion command for local calendar events. This is expected for a calendar manager, but it is still local data mutation that users should invoke carefully.

Skill content

python scripts/mdcal.py delete <event_id>

Recommendation

List events and confirm the event ID before asking the agent to delete an event.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or require users to install a Python dependency that is not declared in the registry metadata.

Why it was flagged

The script imports the external rich package, while the metadata declares no install spec or required binaries/dependencies. This is an under-declared setup requirement rather than evidence of malicious behavior.

Skill content

from rich import print

Recommendation

If installation is needed, install Python dependencies only from trusted package sources and verify what is being added.

Low

#ASI06: Memory and Context Poisoning

What this means

Calendar entries may contain personal schedule details that remain in local files after the immediate task is done.

Why it was flagged

Calendar event titles, descriptions, and reminder settings are stored persistently on disk and may be read back into future agent context.

Skill content

日历文件: `~/.openclaw/workspace/calendar/YYYY-MM.md` ... 提醒文件: `~/.openclaw/workspace/calendar/reminders.json`

Recommendation

Keep the calendar directory private, avoid storing secrets in event descriptions, and review MDCAL_DIR before redirecting storage.