Calendar Planner

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:50 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed calendar-planning helper with local review scripts and optional provider CLI recipes, but users should be careful with calendar write permissions.

Install only if you are comfortable letting an agent help inspect calendar metadata and prepare calendar actions. Prefer read-only provider scopes for audits and planning; grant write scopes only after reviewing the exact calendar, event details, and side effects. Use the optional local memory only for high-level planning rules, not sensitive event details or credentials.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: commands.md:20

Finding

Microsoft Graph Recipe Requests Unnecessary Calendar Write Access

Content

View full analysis

Vulnerability Details

File Location: commands.md, lines 20–25
Vulnerability Type: Excessive delegated OAuth permissions
Risk Level: Medium

Vulnerable Code

powershell

Import-Module Microsoft.Graph.Calendar
Connect-MgGraph -Scopes "Calendars.Read","Calendars.ReadWrite"
Get-MgUserCalendarView -UserId $userId -StartDateTime "2026-03-09T00:00:00+01:00" -EndDateTime "2026-03-16T00:00:00+01:00"
New-MgUserEvent -UserId $userId -Subject "Weekly review" -Start @{DateTime="2026-03-14T17:00:00";TimeZone="Europe/Madrid"} -End @{DateTime="2026-03-14T17:45:00";TimeZone="Europe/Madrid"}

Technical Analysis

The Microsoft Graph adapter recipe requests both Calendars.Read and Calendars.ReadWrite during initial authentication. Calendars.ReadWrite already includes calendar-reading capability and grants substantially more authority than is necessary for read-only operations such as retrieving a calendar view, checking conflicts, or preparing a proposed schedule.

This conflicts with the project's stated least-privilege and approval model. Although the documentation instructs the agent to obtain approval before calendar writes, authorization is granted at connection time, before any operation-specific approval. Application-level instructions do not technically constrain an OAuth token that already possesses write access.

Attack Path

1. A user asks the agent to inspect an Outlook calendar or perform a read-only conflict audit.
2. The agent follows the documented Microsoft Graph recipe.
3. Connect-MgGraph requests Calendars.ReadWrite despite the task requiring only read access.
4. The user grants the requested delegated permission.
5. The resulting Graph session can create, modify, or delete calendar events.
6. A compromised agent session, malicious local process, misused PowerShell command, or other code operating through that authenticated session can perform unauthorized calendar writes without ...[truncated 660 chars]

Remediation

View remediation

Remediation Suggestions

Separate read-only and write-enabled authentication flows:

powershell

# Default read-only workflow
Import-Module Microsoft.Graph.Calendar
Connect-MgGraph -Scopes "Calendars.Read"
Get-MgUserCalendarView -UserId $userId `
  -StartDateTime "2026-03-09T00:00:00+01:00" `
  -EndDateTime "2026-03-16T00:00:00+01:00"

Only request write access after the user explicitly approves a specific calendar modification:

powershell

# Run only after explicit write approval
Disconnect-MgGraph
Connect-MgGraph -Scopes "Calendars.ReadWrite"
New-MgUserEvent -UserId $userId `
  -Subject "Weekly review" `
  -Start @{DateTime="2026-03-14T17:00:00";TimeZone="Europe/Madrid"} `
  -End @{DateTime="2026-03-14T17:45:00";TimeZone="Europe/Madrid"}

Additional hardening measures:

• Do not request both scopes because Calendars.ReadWrite subsumes read access.
• Place read and write commands in clearly separated documentation sections.
• Make Calendars.Read the documented default.
• Display the exact target calendar, event data, and side effects before elevating permission.
• Disconnect or clear the Graph context after completing the approved write.
• Where supported, apply tenant consent policies and conditional-access controls to limit delegated calendar write access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a multi-provider calendar planning tool with adapters for several calendar systems, conflict repair, and weekly reviews. The supplied code does not connect to any calendar services, does not modify or repair events, and does not perform planning across systems. Instead, it operates solely on a local normalized JSON file, groups events by day, checks for overlaps, short buffers, and overload thresholds, and prints a textual report. While overlap detection is related to calendar conflict analysis, the implemented behavior is materially narrower than the declared purpose and omits the key advertised capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code’s actual behavior is limited to merging and normalizing event arrays from JSON files supplied on the command line. It does not contain adapters or service integrations for the named calendar providers, does not perform scheduling/planning actions, and does not implement conflict repair or weekly reviews. While calendar merging is loosely related to the declared domain, the declared description substantially overstates the implemented capabilities and platform support.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The implemented code only analyzes an input JSON file and produces a weekly planning summary. It does not connect to or operate across any calendar services, does not include adapter logic for Google/Outlook/Apple/CalDAV, and does not perform conflict repair. While the weekly review aspect is partially represented by the summary output, the broader declared purpose materially overstates the skill's actual capabilities and primary behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises file-based continuity and references multiple local files and scripts, but it does not declare an explicit tool scope such as allowed file-read paths or permissions. In an agent ecosystem, missing scope boundaries can let the runtime grant broader file access than intended, increasing the chance of unauthorized reads from unrelated local files.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

- Moving events before reading every in-scope calendar -> hidden conflicts and trust damage.
- Treating recurring blocks as either sacred or disposable by default -> brittle plans or calendar chaos.
- Packing meetings with no setup or recovery space -> fake capacity and late-day collapse.
- Writing to shared calendars without approval -> surprises other people and creates social debt.
- Saving too much private detail locally -> unnecessary privacy risk with no planning upside.

## External Endpoints

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

- Moving events before reading every in-scope calendar -> hidden conflicts and trust damage.
- Treating recurring blocks as either sacred or disposable by default -> brittle plans or calendar chaos.
- Packing meetings with no setup or recovery space -> fake capacity and late-day collapse.
- Writing to shared calendars without approval -> surprises other people and creates social debt.
- Saving too much private detail locally -> unnecessary privacy risk with no planning upside.

## External Endpoints

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

md

- Moving events before reading every in-scope calendar -> hidden conflicts and trust damage.
- Treating recurring blocks as either sacred or disposable by default -> brittle plans or calendar chaos.
- Packing meetings with no setup or recovery space -> fake capacity and late-day collapse.
- Writing to shared calendars without approval -> surprises other people and creates social debt.
- Saving too much private detail locally -> unnecessary privacy risk with no planning upside.

## External Endpoints

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

md

This skill NEVER:
- Modifies its own skill file
- Auto-accepts invites or auto-reschedules people without approval
- Widens access from one calendar to another without confirmation
- Stores credentials in local memory files

## Related Skills

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup text instructs activation on a broad set of common productivity intents such as calendar planning, schedule repair, weekly planning, appointments, and multi-calendar coordination. Overly broad activation criteria can cause the skill to trigger in conversations where the user did not explicitly want this capability, increasing the chance of unintended memory writes or calendar-oriented guidance being surfaced out of context. The risk is limited because the file also emphasizes asking consent before creating persistent storage and keeping persistence explicit.

Content

No source excerpt is available for this finding.