Calcom Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

This Cal.com skill matches its stated calendar-management purpose, but its setup uses mutable remote code execution and it enables account-changing calendar actions without strong scoping or confirmation guidance.

Review this skill carefully before installing. Only use it if you are comfortable running unpinned third-party setup commands, linking a CLI into your PATH, and storing a Cal.com API token in a local file. Prefer installing dependencies through trusted, pinned, verified channels; restrict token scope if Cal.com supports it; check file permissions on the token; and require explicit confirmation before any create, update, delete, cancel, confirm, or reschedule action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45
• Finding: Unverified Remote Installer Downloaded and Executed by Bash## Vulnerability Details **File Location**: `SKILL.md`, line 45 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical **Vulnerable Code**: ```bash bun --version || curl -fsSL https://bun.sh/install | bash ``` ### Technical Analysis If Bun is unavailable, the command downloads the current content served by `https://bun.sh/install` and immediately executes it with Bash. It does not pin a version, validate a checksum or signature, save the script for inspection, or request confirmation before execution. Although the domain appears associated with the Bun project and HTTPS protects the connection in transit, the effective code can change after this Skill has been reviewed. Compromise of the hosting service, distribution infrastructure, domain, or maintainer account could consequently turn this installation command into an arbitrary code-execution channel. Installing Bun may facilitate the documented CLI build process, but granting mutable remote content immediate shell execution exceeds the minimum privileges necessary. Bun can instead be treated as a prerequisite or installed from a pinned and cryptographically verified artifact. ### Attack Path 1. A user or agent follows the setup instructions on a system where `bun` is unavailable. 2. The fallback expression invokes `curl` against the remote installer endpoint. 3. The endpoint or its delivery infrastructure serves compromised or unexpectedly modified shell code. 4. The pipe passes that content directly to Bash without verification or review. 5. The payload executes with all permissions of the account running the setup command. ### Impact Assessment A malicious installer could execute arbitrary commands with the invoking user's privileges. This may allow access to user-readable credentials and API tokens, modification or deletion of user files, alteration of shell configuration, installation of additional software, and network ...[truncated 165 chars]
• Remediation: ## Remediation Suggestions - Remove the `curl | bash` installation pipeline. - Treat Bun as an explicit prerequisite and direct users to a trusted platform package manager. - If automated installation is essential, pin a specific Bun release and download its release artifact separately. - Verify the artifact against a trusted published checksum or cryptographic signature before executing or installing it. - Fail safely when verification is unavailable or unsuccessful. - Display the source, version, and planned installation action and obtain explicit user confirmation before making system changes. - Run installation with ordinary user privileges and do not recommend `sudo` unless a narrowly defined platform operation requires it.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:40
• Finding: Unpinned Third-Party Package and Mutable Repository Source Used During Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 40-47 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High **Vulnerable Code**: ```bash npx api2cli install Melvynx/calcom-cli ``` ```bash bun --version || curl -fsSL https://bun.sh/install | bash npx api2cli bundle calcom npx api2cli link calcom ``` ### Technical Analysis The setup invokes `api2cli` through `npx` without an exact package version or integrity constraint. Depending on local cache and npm behavior, this can retrieve and execute the package version currently resolved by the registry. The GitHub source is also identified only as `Melvynx/calcom-cli`, without a reviewed commit hash, immutable release tag, signature, or checksum. As a result, the code installed, bundled, and linked at setup time may differ from the code that was originally audited. The `link` operation additionally exposes the resulting executable through the user's command search path. This behavior is relevant to the Skill's installation, but mutable dependencies are not necessary for its calendar-management functionality and exceed a least-trust installation model. ### Attack Path 1. A user or agent runs `npx api2cli install Melvynx/calcom-cli`. 2. `npx` resolves an unpinned `api2cli` package from the configured npm registry. 3. `api2cli` retrieves mutable content associated with the unpinned GitHub repository reference. 4. A compromised registry package, maintainer account, repository branch, or release process supplies altered code. 5. The setup bundles that code and links the generated command into `~/.local/bin`. 6. Subsequent apparently legitimate `calcom-cli` calls execute the altered implementation. ### Impact Assessment Exploitation could provide arbitrary code execution with the installing user's privileges during package installation, bundling, linking, or later CLI invocation. A malicious dependency could access the Cal.com token and ...[truncated 280 chars]
• Remediation: ## Remediation Suggestions - Pin `api2cli` to an exact reviewed version, such as `npx api2cli@<exact-version>`, rather than relying on registry resolution of the latest version. - Use npm integrity metadata and a lockfile where the installation workflow supports them. - Pin `Melvynx/calcom-cli` to a reviewed commit hash or cryptographically signed, immutable release. - Verify downloaded source and release artifacts using trusted checksums or signatures. - Avoid executing package lifecycle scripts unless they are required and audited. - Present the exact package version, repository revision, destination, and PATH modification before installation. - Require explicit approval before linking an executable or changing the user's command environment. - Periodically re-audit pinned dependency updates before advancing their versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59
• Finding: Cal.com API Token Stored in a Predictable Plaintext File## Vulnerability Details **File Location**: `SKILL.md`, lines 59-64 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium **Vulnerable Code**: ```bash calcom-cli auth set "your-token" calcom-cli auth test ``` ```text Auth commands: `auth set <token>`, `auth show`, `auth remove`, `auth test` Token is stored in `~/.config/tokens/calcom-cli.txt`. ``` ### Technical Analysis The documentation states that the Cal.com API token is stored at a predictable filesystem location. It does not document encryption, use of an operating-system credential store, restrictive directory and file permissions, or controls preventing the token from being displayed by `auth show`. Plaintext file storage is not automatically exploitable when permissions are correctly restricted, but the Skill provides no assurance that the directory is mode `0700` or that the token file is mode `0600`. The predictable location also simplifies discovery by another local process operating under the same account or by malware with user-level filesystem access. ### Attack Path 1. The user runs `calcom-cli auth set` and supplies a valid Cal.com API token. 2. The CLI writes the token to `~/.config/tokens/calcom-cli.txt`. 3. The file is copied into an insecure backup, receives permissive permissions, or is read by another process with access to the user's files. 4. The exposed token is reused to authenticate to Cal.com. 5. The attacker performs API operations allowed by the token until it is revoked or expires. ### Impact Assessment Exposure of the token could permit unauthorized access to the user's Cal.com account within the token's API permissions. Based on the documented Skill capabilities, this may include reading profile and booking information, inspecting schedules, creating or changing event types, canceling or rescheduling bookings, confirming pending bookings, and modifying availability. The exact scope depen ...[truncated 92 chars]
• Remediation: ## Remediation Suggestions - Store the token in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux Secret Service implementation. - If file storage is unavoidable, create the containing directory with mode `0700` and the token file with mode `0600`. - Create the file atomically with restrictive permissions rather than writing it first and changing permissions afterward. - Reject or warn about token files that are group-readable, world-readable, or owned by another user. - Ensure `auth show` redacts the token by default and never includes it in JSON output, logs, diagnostics, or shell history. - Document token revocation, rotation, and secure removal procedures. - Encourage narrowly scoped, short-lived tokens where Cal.com supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain

Content

If `calcom-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle calcom
npx api2cli link calcom
```

• Confidence: 99% confidence
• Finding: The skill includes `curl -fsSL https://bun.sh/install | bash`, which fetches a remote script and executes it immediately without verification. This is a classic remote code execution and supply-chain risk: if the endpoint, transport, or served script is compromised, arbitrary commands run with the user's privileges.

Chaining Abuse

High

• Category: Tool Misuse

Content

If `calcom-cli` is not found, install and build it:
```bash
bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle calcom
npx api2cli link calcom
```

• Confidence: 99% confidence
• Finding: The `| bash` pattern chains network retrieval directly into shell execution, eliminating any opportunity for inspection or integrity verification. In this skill, that danger is amplified because the command is presented as a setup prerequisite, making users more likely to run it verbatim.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger description includes broad terms like 'scheduling' and 'bookings', which may cause the skill to activate for generic calendar requests not explicitly intended for Cal.com. In context, this is risky because the skill supports authenticated and destructive operations against a real external service, increasing the chance of unintended API actions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises destructive operations such as deleting schedules and canceling/rescheduling bookings without warning about side effects or recommending user confirmation. In a calendar-management context, unintended mutations can disrupt meetings, availability, and business workflows.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The skill instructs users to execute `npx api2cli install Melvynx/calcom-cli` without pinning an exact package version or immutable source reference. This creates a supply-chain risk where a future compromised or malicious package version could be fetched and executed in the user's environment.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: `npx api2cli bundle calcom` invokes a non-pinned tool version, so the behavior and code executed can change over time. In a skill that encourages installation/build steps, this materially increases supply-chain exposure because agents or users may run newly published code without review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: `npx api2cli link calcom` again depends on an unpinned package/toolchain and modifies local execution paths by linking binaries. If the upstream package is compromised, this can persist unsafe tooling into the user's PATH and affect later commands.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The authentication section tells users to store an API token locally in a predictable plaintext path without any credential-handling or privacy warning. This increases the risk of token disclosure through local compromise, backups, shared systems, or accidental exfiltration by other tools.

Static analysis

No suspicious patterns detected.