ICS CRM Reminder

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.0

Overview

This skill does what it claims by creating local calendar reminder files, but those files can include sensitive customer and deal details.

Install only if you are comfortable creating local calendar files that may contain CRM and personal contact details. Keep confidential notes, sensitive budget terms, and internal sales status out of reminders that could be synced to Apple, Google, Outlook, shared devices, backups, or forwarded calendar invites.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill performs file-writing behavior by generating and saving ICS files, but it does not declare a corresponding permission. Undeclared write capability weakens security review and user consent because the agent can persist files in the workspace without an explicit capability boundary.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs storing ICS files that embed customer contact details, deal phase, budget, notes, and next steps directly in calendar event descriptions, but it provides no privacy or data-handling warning. Because ICS files are easily imported, synced, forwarded, or exposed through calendar systems, this can lead to unintended disclosure of sensitive business and personal data.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script writes CRM data, including customer identity, contact details, deal phase, budget, notes, and next steps, into an .ics file on disk without any warning, minimization, or protection. In the context of a CRM reminder generator, this materially increases the chance of sensitive business data being stored in plaintext, synced to third-party calendar systems, or exposed via shared machines, backups, or misdirected files.

VirusTotal

65/65 vendors flagged this skill as clean.