Feishu calendar sync, local ics to json data for AI agent

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:50 PM UTC
• Version: 1.0.1

Overview

The skill mainly converts calendar files to JSON, but it also asks users to install and configure calendar syncing without enough scope, source, or privacy guidance.

Review this skill carefully before installing. The local converter script is straightforward, but avoid setting up calendar synchronization unless you understand which calendars, credentials, and files it will access; use trusted package sources and keep generated JSON files private or redacted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10

Finding

Unpinned and Unnecessary Calendar Synchronization Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 10
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Low

Code Snippet:

markdown

## requirement

install vdirsyncer and setup calendar sync

Technical Analysis

The Skill instructs users to install vdirsyncer without identifying an official distribution source, specifying a version, or providing integrity verification. The bundled conversion script does not import or invoke vdirsyncer; it only uses the Python icalendar package to parse local ICS files. Consequently, this installation instruction introduces an unnecessary supply-chain dependency beyond the stated ICS-to-JSON functionality.

Because no installation command or package source is prescribed, users may obtain an outdated, compromised, typosquatted, or otherwise untrusted package. The additional instruction to configure calendar synchronization may also cause users to provide calendar credentials to software that the local conversion operation does not require.

Attack Path

1. A user loads the Skill and follows the documented prerequisite.
2. The user searches for or installs vdirsyncer from an unverified package source because the documentation identifies neither a trusted source nor a verified version.
3. An attacker-controlled or compromised package executes installation hooks or runtime code with the installing user's privileges.
4. If the user follows the synchronization setup instruction, the malicious dependency may gain access to configured calendar credentials and synchronized calendar data.

This path depends on the user obtaining a compromised or impersonated dependency; the repository itself does not download or execute a remote payload.

Impact Assessment

Potential execution is limited initially to the privileges of the account performing the installation, although impact may increase if installation is performed with a ...[truncated 324 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the vdirsyncer installation and synchronization requirement because the current script does not use it.
2. Document the dependency that the script actually imports, icalendar, in a version-pinned dependency manifest such as requirements.txt.
3. Pin dependencies to reviewed versions and, where practical, require package hashes using a lock file or pip --require-hashes.
4. If synchronization is added later, identify the official package repository and exact supported version, document integrity verification, and explain why synchronization is necessary.
5. Require least-privilege installation, avoid administrative installation where possible, and document secure storage and minimum scopes for calendar credentials.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill processes ICS calendar files and exports their contents to JSON, but it does not warn users that calendar data commonly contains sensitive personal information such as meeting titles, attendee details, locations, schedules, and reminders. This omission can lead users to unintentionally expose private data through generated JSON files, especially if those files are shared, logged, or stored insecurely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains user-facing or maintainer-facing natural-language text in Chinese comments/docstrings such as '解析单个 ICS 文件' and '处理目录中的所有 ICS 文件' without offering any language choice or documenting a locale-specific purpose. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.