Calendar Planner

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:15 PM UTC
• Version:
  1.0.0

Overview

Calendar Planner is a disclosed calendar-planning skill that uses local analysis scripts and user-approved calendar CLI tools, with no hidden execution or silent writes found.

Install only if you are comfortable using calendar CLI tools with your calendar metadata. Prefer read-only scopes until you need changes, review every proposed write command and target calendar before approval, and periodically delete local merged exports or ~/calendar-planner/ notes if they contain sensitive schedule context.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The skill markets itself as providing live multi-calendar planning across Google, Outlook, Apple Calendar, and CalDAV, but the analyzed content appears to only describe local analysis scripts and playbooks rather than actual adapter enforcement or connectivity. This mismatch can mislead users into granting trust, installing dependencies, or exposing calendar exports under false assumptions about what the skill can really do and what controls are actually implemented.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases include very generic language such as "fix my schedule" and "where does this fit?", which can plausibly appear in ordinary conversation outside an explicit calendar-planning request. In an agent environment, broad triggers can cause unintended invocation of calendar-planning behaviors, leading to unexpected access to scheduling data, incorrect workflow routing, or accidental modification recommendations based on irrelevant context.

VirusTotal

65/65 vendors flagged this skill as clean.