ClawHub
Back to skill

Security audit

calmly

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for managing macOS Calendar, but it installs an unpinned third-party Homebrew binary that would handle sensitive calendar data.

Review the upstream calmly project and Homebrew tap before installing, prefer a pinned and verified release if available, and grant Calendar access only if you trust the installed binary to read and create events in your calendars.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:10
Finding

Unpinned Third-Party Homebrew Tap

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–15 and 30–35
Vulnerability Type: Unverified, mutable third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
install:
  - id: brew
    kind: brew
    formula: halbotley/tap/calmly
    bins: ["calmly"]
    label: "Install calmly (brew)"
bash
brew tap halbotley/tap
brew install calmly

Technical Analysis

The Skill installs the calmly executable from the third-party Homebrew tap halbotley/tap without pinning a reviewed release, tap commit, artifact checksum, or cryptographic signature. Because the executable and its source are not included in the audited project, their behavior cannot be verified from this package.

A custom Homebrew tap is a mutable external supply-chain dependency. If its repository, maintainer account, formula, source archive, or build infrastructure is compromised, the installation process could retrieve and execute attacker-controlled code under the installing user's account. The concern is amplified because the resulting program is expected to receive macOS Calendar permission and process potentially sensitive calendar information.

The documentation otherwise aligns with the declared calendar-management purpose. No evidence of intentional malicious behavior, embedded code, credential theft, persistence, obfuscation, or instruction hijacking was found in the reviewed file.

Attack Path

  1. An attacker compromises the third-party tap, its maintainer account, the formula's referenced artifact, or associated release infrastructure.
  2. The attacker modifies the formula or downloadable artifact to install or execute a malicious payload.
  3. A user or agent follows the documented brew tap and brew install commands.
  4. Homebrew retrieves the mutable dependency and executes its installation logic under the user's account.
  5. The installed executable may run with the user's privileges and request Calendar access.
  6. If permission is ...[truncated 917 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation to a specific reviewed release and immutable source commit rather than implicitly trusting the tap's latest state.
  2. Publish and verify cryptographic checksums for downloaded release artifacts.
  3. Prefer signed releases and verify signatures against a documented maintainer key.
  4. Document the upstream source repository and the exact formula revision used by the Skill.
  5. Review the Homebrew formula, source code, build process, and dependencies before recommending installation.
  6. Consider using an official or more strongly governed distribution channel where available.
  7. Apply least privilege when granting macOS Calendar access and instruct users to revoke that permission when the tool is no longer needed.
  8. Add dependency monitoring so changes to the tap, formula, release artifacts, or ownership trigger a new security review.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.