Calendar Local

• Analyzed: Mar 31, 2026, 1:11 AM
• Findings: 1
• Version: 1.0.0
• Hash: f3049160c34c6198eec1c45a4c45333aaf5855f0a78217a2b07870cdd4a0f389
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates local Google Calendar access by executing a shell script at a hardcoded path (/home/ubuntu/.openclaw/workspace/.openclaw/calendar.sh). It is classified as suspicious due to a potential shell injection vulnerability in the 'days N' command workflow, where the variable 'N' is derived from user input without explicit sanitization instructions in SKILL.md. While the use of the GOG_KEYRING_PASSWORD environment variable is consistent with the stated purpose, the reliance on an external, unprovided script and the lack of input validation pose a security risk.