Calendar Manager

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

The skill is a simple calendar-management instruction package with no embedded code or hidden behavior, though users should understand the calendar data and installer risks before using it.

Before installing, consider using a reviewed or pinned ClawHub installer version instead of a mutable latest tag. Treat event titles, attendees, times, reminders, and shared calendars as sensitive data, and only use sharing or notifications where you understand who receives the information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7–9
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx clawhub@latest install calendar-manager

Technical Analysis

The documented installation procedure instructs users to execute the latest available release of the clawhub npm package. The @latest tag is mutable and does not identify a specific, previously audited package version. Consequently, the code executed by this command can change after the skill has been reviewed.

npx may download the selected package and execute its command-line entry point locally. If the upstream package, maintainer account, publishing pipeline, or npm distribution channel is compromised, a malicious release assigned to the latest tag could run arbitrary code during installation. No malicious package payload is present in the audited project itself; the risk arises from dynamically trusting a mutable third-party dependency.

Attack Path

1. An attacker compromises the upstream npm package, a maintainer account, or its release pipeline.
2. The attacker publishes a malicious clawhub release and assigns it to the mutable latest distribution tag.
3. A user follows the README and runs npx clawhub@latest install calendar-manager.
4. npx retrieves the attacker-controlled release and executes its CLI entry point.
5. The malicious package performs actions using the privileges and environment of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the user running the installation command. Depending on that user's permissions and environment, the package could read or modify accessible files, access environment variables and developer credentials, alter project configuration, or initiate network connections.

The direct scope is the local account and resources ava ...[truncated 301 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Commit and verify the expected package integrity hash where the installation workflow supports integrity enforcement.
• Document the authoritative package registry and publisher identity so users can detect dependency-confusion or package-substitution attempts.
• Review the pinned package version, including lifecycle scripts and transitive dependencies, before recommending it.
• Use a lockfile or equivalent immutable dependency manifest in automated installation workflows.
• Avoid running the installer with administrative privileges and execute it in a restricted environment with only the permissions required for installation.
• Establish a controlled update process in which version changes are explicitly reviewed before the documented command is updated.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install calendar-manager, which pulls and executes the latest published package version without pinning. This creates a supply-chain risk: if the package or a dependency is compromised later, users may execute attacker-controlled code simply by following the installation instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises calendar sharing and reminder/notification features but provides no warning that the skill may access, expose, or transmit sensitive schedule data. In a calendar-management context, event contents, attendees, times, and reminders often contain personal or business-sensitive information, so missing privacy and user-impact disclosure increases the chance of unintended data exposure or unexpected actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description and body text use Chinese exclusively, which can impose a specific language on users without opt-in. Under the language/locale policy rule, this is a natural-language policy concern unless the skill offers a language choice or clearly states that it is intended for a Chinese-only context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill description is written entirely in Chinese, which can indicate a fixed language/locale presentation without user opt-in. The file does not mention that the skill is intended only for Chinese-speaking users or provide any language choice, which may conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.