Calendar Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:28 PM UTC
• Version: 1.1.0

Overview

This calendar skill is coherent, but it combines sensitive calendar access with automatic event creation and persistent reminder examples without enough user-control boundaries.

Install only if you are comfortable granting calendar access and possibly email-derived scheduling workflows. Before use, require explicit approval for every event creation, modification, deletion, or reminder email, avoid automatic event creation from untrusted emails, install dependencies in an isolated environment with pinned versions where possible, and do not create scheduled tasks unless you understand how to inspect and remove them.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: references/resources.md:103

Finding

Persistent Execution Through a Windows Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: references/resources.md, lines 103-110
Vulnerability Type: System persistence through scheduled task registration
Risk Level: High

Vulnerable Code

powershell

# 创建每日任务
$action = New-ScheduledTaskAction -Execute "python.exe" -Argument "script.py"
$trigger = New-ScheduledTaskTrigger -Daily -At "8:00AM"
Register-ScheduledTask -Action $action -Trigger $trigger -TaskName "DailyTask"

Technical Analysis

The documented commands register a Windows scheduled task that executes python.exe script.py every day. This creates a cross-session execution mechanism that remains active after the original skill operation has ended.

Both executable and script paths are unqualified. The project does not include or identify the expected script.py, meaning resolution depends on the scheduled task's runtime environment, working directory, and executable search behavior. An attacker able to influence the resolved script or interpreter could use the scheduled task as a recurring execution mechanism.

Although presented as a reference example rather than automatically executed code, following the instructions without additional validation creates system persistence.

Attack Path

1. A user or agent follows the documented commands and registers DailyTask.
2. An attacker places or replaces a file that resolves as script.py, or influences which python.exe is selected.
3. Windows Task Scheduler triggers the task daily at 8:00 AM.
4. The attacker-controlled code executes under the security context configured for the task.
5. Execution continues across sessions until the task is disabled or removed.

Impact Assessment

Exploited code can obtain the permissions of the account under which the scheduled task runs. For a normal user, this may expose that user's files, credentials available to local processes, and calendar-related data. If the task is registered by an ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the scheduled-task example unless persistent execution is essential to the skill.

• Require explicit user consent before creating any persistent task.

• Use absolute, canonical paths for both the Python interpreter and the reviewed script.

• Include the intended script in the audited project and verify its integrity before registration.

• Configure the task with the least-privileged account required for its purpose.

• Set an explicit working directory and prevent untrusted users from modifying the interpreter, script, or parent directories.

• Use a collision-resistant, application-specific task name and verify that an existing task is not overwritten.

• Document task inspection and removal, for example:

  powershell

  Unregister-ScheduledTask -TaskName "DailyTask" -Confirm:$false
  

• Prefer a non-persistent reminder mechanism when persistent background execution is not necessary.

T08 · Insecure Dependencies

Warning

• Location: references/resources.md:6

Finding

Unpinned Third-Party Python Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/resources.md, lines 6-9
Vulnerability Type: Unpinned dependency installation without integrity verification
Risk Level: Medium

Vulnerable Code

bash

# Python
pip install gcalcli

Technical Analysis

The installation command retrieves the currently selected gcalcli release and its transitive dependencies without a version constraint or cryptographic hash. Consequently, the installed code can change after the skill has been reviewed.

Python packages and their build or installation components may execute code during installation, while the installed application executes with the invoking user's privileges when used. A compromised upstream release, package index, maintainer account, or transitive dependency could therefore introduce code that was not part of this audit.

The command also does not require an isolated environment or identify the trusted package index, increasing the possibility of environment contamination or package-source manipulation.

Attack Path

1. An attacker compromises the package, one of its dependencies, its publisher account, or a package source used by pip.
2. A malicious or altered release becomes the version selected by the unpinned command.
3. A user or agent runs pip install gcalcli.
4. The malicious package code executes during installation or when the calendar utility is invoked.
5. The code operates with the permissions and data access available to the invoking user, potentially including calendar authentication material.

Impact Assessment

A compromised dependency can execute commands with the invoking user's privileges. Potential scope includes user-accessible files, environment variables, calendar data, OAuth credentials available to the process, and other local resources.

Installation under an elevated account or into a shared system environment would increase the impact and could affect ot ...[truncated 121 chars]

Remediation

View remediation

Remediation Suggestions

• Pin gcalcli to a specifically reviewed version.

• Use a lock file or requirements file containing cryptographic hashes, and install with hash enforcement:

  bash

  pip install --require-hashes -r requirements.txt
  

• Pin and hash all transitive dependencies, not only the top-level package.

• Explicitly use the expected official package index and reject unexpected extra indexes or mirrors.

• Install the dependency in a dedicated virtual environment under a non-privileged account.

• Review package provenance, maintainer information, release history, and published artifacts before updating.

• Add an update process that re-audits dependency changes before modifying pinned versions or hashes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description and activation framing are broad enough that a calendar-managing capability could be invoked for loosely related user requests without a clearly bounded intent check. In a skill that can read and mutate personal calendar data, ambiguous triggering increases the chance of unintended data access or accidental action execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises create/modify/delete capabilities for calendar events without clearly warning that it performs data-changing actions or requiring confirmation boundaries. In a personal productivity context, unintended mutations can disrupt schedules, leak attendance information, or cause missed meetings.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase '设置提醒' is generic and can match many contexts that do not necessarily imply consent to access or alter calendar/reminder data. Because this skill can create reminders or events, an underspecified trigger can cause unintended state changes or privacy-impacting access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A timed or automatic reminder for 'upcoming events' implies proactive invocation without a fresh, explicit user request. That creates a risk of unsanctioned access to sensitive schedule data and autonomous behavior beyond what the user may expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically creating calendar events from emails combines two sensitive data domains and can cause the agent to act on untrusted or misinterpreted message content. This is more dangerous in context because email invitations can be spoofed, malformed, or socially engineered, leading to unauthorized event creation, spam, or disclosure of scheduling patterns.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description is written in Chinese and mixes some English terms, but there is no indication that the skill is region-specific or that the user can choose their preferred language. This may violate language or locale policy if the broader environment expects user language choice rather than a fixed language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all instructions, headings, and examples in Chinese, and does not indicate that the skill is region-specific or that users may choose another language. That can violate a language/locale policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.