ClawHub
Back to skill

Security audit

Aerobase Calendar

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Google Calendar flight-sync skill, but it will read and change calendar data after a user connects Google Calendar.

Install only if you are comfortable connecting Google Calendar to Aerobase. Review the OAuth consent screen and sync preferences, and expect the skill to read upcoming event details and automatically create, update, or remove travel-related calendar entries. Use the disconnect option if you no longer want Aerobase-mediated calendar access.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes reading existing calendar events and creating or modifying entries, but it does not present any user-facing disclosure or consent language explaining that personal calendar contents will be accessed and changed. Calendar data often contains sensitive business, medical, travel, and relationship information, so silent access or mutation increases privacy and trust risks even if the backend uses legitimate OAuth.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documented OAuth connection to Google Calendar omits a privacy warning that a third-party calendar account will be linked and that event data will flow through Aerobase backend APIs. Even when tokens are backend-mediated, users need clear disclosure because this expands the trust boundary beyond Google and exposes potentially sensitive calendar metadata and content to another service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal