ClawHub
Back to skill

Security audit

cal-candy: a Markdown calendar

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward local Markdown calendar tool that reads and edits local calendar files, with normal caution needed around deletion.

Install only if you want a local script to create and modify calendar files. Before deleting, ask the agent to list the event and confirm the exact event ID, and avoid pointing MDCAL_DIR at a directory containing unrelated Markdown files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is broad enough to activate on generic requests about schedules, reminders, or time-bound tasks, which can cause the agent to invoke this skill in contexts the user did not clearly intend. Because the skill supports state-changing actions like add and delete against local files, over-triggering raises the chance of unintended calendar modification or disclosure of local schedule data.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation exposes a destructive delete command without any warning, confirmation step, or recovery guidance. In a local file-based calendar system, accidental or overly eager agent use of this command could permanently remove user events, especially when combined with broad triggers or ambiguous user requests.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.