Apple Calendar CLI

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:37 AM UTC
• Version: 1.0.0

Overview

This is a straightforward Apple Calendar helper, but it depends on a globally installed third-party npm CLI that users should verify first.

Install only if you are comfortable granting a third-party CLI access to Apple Calendar. Prefer verifying the npm package and source, pinning a reviewed version, using a non-admin account, limiting calendar/date ranges, and confirming any create, update, or delete action before it runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-10
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Installation

```bash
npm install -g @joargp/accli

text

### Technical Analysis

The installation instructions retrieve and globally install the latest version of `@joargp/accli` without specifying an exact version, integrity hash, lockfile, or verified artifact source. Consequently, the code installed at execution time may differ from the code that was available when this skill was reviewed.

npm packages can define lifecycle scripts that execute during installation. If the package publisher account, package release process, registry entry, or a transitive dependency is compromised, following this instruction could execute attacker-controlled code with the privileges of the user running npm. Global installation also increases exposure by making the installed command available across the user's environment.

The audited project does not contain the package implementation, so this finding does not establish that `@joargp/accli` is malicious. It identifies an unsafe and mutable dependency-installation mechanism.

### Attack Path

1. An attacker compromises the npm publisher account, release pipeline, package registry entry, or a transitive dependency associated with `@joargp/accli`.
2. The attacker publishes a malicious release under the same package name or introduces malicious installation/runtime code into a dependency.
3. A user or agent follows `SKILL.md` and runs `npm install -g @joargp/accli`.
4. npm resolves the current package version rather than a previously reviewed, immutable version.
5. Attacker-controlled lifecycle or runtime code executes with the installing user's privileges.
6. The malicious code can access resources available to that user, including local files and calendar data, a
...[truncated 720 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version instead of installing the mutable latest release:

   bash

   npm install -g @joargp/accli@<reviewed-exact-version>
   

2. Verify the downloaded package against a documented integrity hash or other authenticated release signature.
3. Document and verify the package's canonical npm registry page and source repository before installation.
4. Audit the selected release, its lifecycle scripts, and all transitive dependencies.
5. Prefer a project-local installation with a committed lockfile over a global installation, then invoke the pinned local binary.
6. Disable npm lifecycle scripts with --ignore-scripts if the reviewed package does not require them.
7. Run the tool as a non-administrative user and grant only the minimum macOS Calendar permissions required.
8. Establish a controlled dependency-update process in which new versions are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger text is broad enough to activate on generic calendar-related requests, which can cause the agent to invoke this skill in situations the user did not specifically intend. Because the skill supports both reading sensitive schedule data and modifying or deleting events, over-invocation increases the chance of unnecessary data exposure or unintended actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documentation describes access to calendars and event management without clearly warning that calendar contents may include sensitive personal, medical, travel, or business information. In this context, missing privacy guidance is risky because the skill is specifically designed to read and modify highly sensitive scheduling data, making accidental over-collection or disclosure more likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.