Recipe Batch Invite To Event

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.12

Overview

This skill is a straightforward Google Calendar recipe for adding attendees to an event and sending invite notifications.

Before using it, verify the active Google account, target calendar event ID, and every attendee email. Running the patch step modifies the event and can send calendar notification emails to the added attendees.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to patch a Google Calendar event with `sendUpdates: "all"` but does not warn that this action will send notification emails to attendees. In a batch-invite recipe, this can cause unintended external communication, spam, or disclosure that an event exists and who is being added, especially if the event ID or attendee list is wrong.

VirusTotal

63/63 vendors flagged this skill as clean.