Security audit

macOS Calendar

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses local macOS Calendar automation to list calendars and create events, with some privacy and confirmation caveats users should understand.

Install only if you want an agent to be able to create real Apple Calendar events on your Mac. Review ambiguous reminder or deadline requests, avoid putting highly sensitive details in event titles if local skill logs are a concern, and be aware Calendar.app may open when the helper runs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/calendar.sh:18
Finding: Insecure Persistent Logging and Log-Record Injection
Content: View full analysis
> "$LOGFILE" } ``` ```python # Safe output: replace newlines in string values (one field per line) def safe(s): return s.replace('\n', ' ').replace('\r', '') ``` ```bash log_action "create-event" "$calendar" "$summary" ``` ### Technical Analysis The script persistently records calendar names and event summaries in `logs/calendar.log`. These fields can contain sensitive personal or business information. The log directory and file are created without explicit restrictive permissions, so their effective access permissions depend on the invoking process's umask and existing filesystem state. The log uses tab-separated fields, but the sanitizer only removes carriage returns and replaces newlines. It does not remove or encode tab characters, despite comments indicating that tabs are handled. An attacker-controlled event summary or calendar name containing tabs can therefore insert additional apparent fields and corrupt the audit-record structure. The redirection operator also follows symbolic links. If an attacker can control the configured log location or prepare entries within a writable log directory, the process may append content to a symlink target accessible to the invoking user. Additionally, the full input JSON is temporarily placed in the `CALENDAR_JSON` environment variable: ```bash validated=$(CALENDAR_JSON="$json" python3 << 'PYEOF' ``` This JSON can include private event descriptions. Depending on operating-system ...[truncated 1687 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/calendar.sh:69
Finding: Weak Type, Date, and Recurrence Validation Can Create Unintended Events
Content: View full analysis
= 0") if alarm_min < 0: errors.append("alarm_minutes must be >= 0") # Validate and normalize iso_date (ensure zero-padded YYYY-MM-DD) if iso_date: parts = iso_date.split('-') if len(parts) != 3: errors.append("iso_date must be YYYY-MM-DD") else: try: y, m, d = int(parts[0]), int(parts[1]), int(parts[2]) if not (1 <= m <= 12 and 1 <= d <= 31 and y >= 1): errors.append("iso_date has invalid date values") else: iso_date = f"{y:04d}-{m:02d}-{d:02d}" except ValueError: errors.append("iso_date must contain numeric values") ``` ### Technical Analysis The implementation broadly coerces JSON values instead of requiring their documented types. In particular, Python treats every non-empty string as true. Consequently: ```python bool("false") == True ``` A caller that submits `"all_day": "false ...[truncated 2317 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes local execution capabilities and depends on environment-derived paths such as $SKILL_DIR, but it does not declare an explicit tool scope or permissions boundary. In an agent system, missing scope metadata can cause the skill to be callable with broader-than-intended execution privileges or without adequate review of its code-execution and environment access requirements.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger description is broad enough to match many ordinary phrases like reminders, deadlines, or scheduling requests, which increases the chance the skill is auto-invoked in situations the user did not clearly intend. Because this skill performs state-changing actions in Calendar and can create persistent events and reminders, accidental invocation has real integrity and privacy consequences beyond a harmless misclassification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script automatically launches Calendar.app and can create calendar events without any explicit confirmation, warning, or dry-run behavior at the script interface. In an agentic context, this creates a side-effecting action that may be triggered by ambiguous or manipulated prompts, causing unauthorized event creation and unexpected application launch on the user's macOS session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.