Calcom Cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:32 AM UTC
• Version: 0.1.0

Overview

This Cal.com skill matches its stated calendar-management purpose, but its setup uses mutable remote code execution and it enables account-changing calendar actions without strong scoping or confirmation guidance.

Review this skill carefully before installing. Only use it if you are comfortable running unpinned third-party setup commands, linking a CLI into your PATH, and storing a Cal.com API token in a local file. Prefer installing dependencies through trusted, pinned, verified channels; restrict token scope if Cal.com supports it; check file permissions on the token; and require explicit confirmation before any create, update, delete, cancel, confirm, or reschedule action.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:45

Finding

Unverified Remote Installer Downloaded and Executed by Bash

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 45
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

bash

bun --version || curl -fsSL https://bun.sh/install | bash

Technical Analysis

If Bun is unavailable, the command downloads the current content served by https://bun.sh/install and immediately executes it with Bash. It does not pin a version, validate a checksum or signature, save the script for inspection, or request confirmation before execution.

Although the domain appears associated with the Bun project and HTTPS protects the connection in transit, the effective code can change after this Skill has been reviewed. Compromise of the hosting service, distribution infrastructure, domain, or maintainer account could consequently turn this installation command into an arbitrary code-execution channel.

Installing Bun may facilitate the documented CLI build process, but granting mutable remote content immediate shell execution exceeds the minimum privileges necessary. Bun can instead be treated as a prerequisite or installed from a pinned and cryptographically verified artifact.

Attack Path

1. A user or agent follows the setup instructions on a system where bun is unavailable.
2. The fallback expression invokes curl against the remote installer endpoint.
3. The endpoint or its delivery infrastructure serves compromised or unexpectedly modified shell code.
4. The pipe passes that content directly to Bash without verification or review.
5. The payload executes with all permissions of the account running the setup command.

Impact Assessment

A malicious installer could execute arbitrary commands with the invoking user's privileges. This may allow access to user-readable credentials and API tokens, modification or deletion of user files, alteration of shell configuration, installation of additional software, and network ...[truncated 165 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash installation pipeline.
• Treat Bun as an explicit prerequisite and direct users to a trusted platform package manager.
• If automated installation is essential, pin a specific Bun release and download its release artifact separately.
• Verify the artifact against a trusted published checksum or cryptographic signature before executing or installing it.
• Fail safely when verification is unavailable or unsuccessful.
• Display the source, version, and planned installation action and obtain explicit user confirmation before making system changes.
• Run installation with ordinary user privileges and do not recommend sudo unless a narrowly defined platform operation requires it.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:40

Finding

Unpinned Third-Party Package and Mutable Repository Source Used During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-47
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code:

bash

npx api2cli install Melvynx/calcom-cli

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle calcom
npx api2cli link calcom

Technical Analysis

The setup invokes api2cli through npx without an exact package version or integrity constraint. Depending on local cache and npm behavior, this can retrieve and execute the package version currently resolved by the registry. The GitHub source is also identified only as Melvynx/calcom-cli, without a reviewed commit hash, immutable release tag, signature, or checksum.

As a result, the code installed, bundled, and linked at setup time may differ from the code that was originally audited. The link operation additionally exposes the resulting executable through the user's command search path. This behavior is relevant to the Skill's installation, but mutable dependencies are not necessary for its calendar-management functionality and exceed a least-trust installation model.

Attack Path

1. A user or agent runs npx api2cli install Melvynx/calcom-cli.
2. npx resolves an unpinned api2cli package from the configured npm registry.
3. api2cli retrieves mutable content associated with the unpinned GitHub repository reference.
4. A compromised registry package, maintainer account, repository branch, or release process supplies altered code.
5. The setup bundles that code and links the generated command into ~/.local/bin.
6. Subsequent apparently legitimate calcom-cli calls execute the altered implementation.

Impact Assessment

Exploitation could provide arbitrary code execution with the installing user's privileges during package installation, bundling, linking, or later CLI invocation. A malicious dependency could access the Cal.com token and ...[truncated 280 chars]

Remediation

View remediation

Remediation Suggestions

• Pin api2cli to an exact reviewed version, such as npx api2cli@<exact-version>, rather than relying on registry resolution of the latest version.
• Use npm integrity metadata and a lockfile where the installation workflow supports them.
• Pin Melvynx/calcom-cli to a reviewed commit hash or cryptographically signed, immutable release.
• Verify downloaded source and release artifacts using trusted checksums or signatures.
• Avoid executing package lifecycle scripts unless they are required and audited.
• Present the exact package version, repository revision, destination, and PATH modification before installation.
• Require explicit approval before linking an executable or changing the user's command environment.
• Periodically re-audit pinned dependency updates before advancing their versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Cal.com API Token Stored in a Predictable Plaintext File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-64
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

bash

calcom-cli auth set "your-token"
calcom-cli auth test

text

Auth commands: `auth set <token>`, `auth show`, `auth remove`, `auth test`

Token is stored in `~/.config/tokens/calcom-cli.txt`.

Technical Analysis

The documentation states that the Cal.com API token is stored at a predictable filesystem location. It does not document encryption, use of an operating-system credential store, restrictive directory and file permissions, or controls preventing the token from being displayed by auth show.

Plaintext file storage is not automatically exploitable when permissions are correctly restricted, but the Skill provides no assurance that the directory is mode 0700 or that the token file is mode 0600. The predictable location also simplifies discovery by another local process operating under the same account or by malware with user-level filesystem access.

Attack Path

1. The user runs calcom-cli auth set and supplies a valid Cal.com API token.
2. The CLI writes the token to ~/.config/tokens/calcom-cli.txt.
3. The file is copied into an insecure backup, receives permissive permissions, or is read by another process with access to the user's files.
4. The exposed token is reused to authenticate to Cal.com.
5. The attacker performs API operations allowed by the token until it is revoked or expires.

Impact Assessment

Exposure of the token could permit unauthorized access to the user's Cal.com account within the token's API permissions. Based on the documented Skill capabilities, this may include reading profile and booking information, inspecting schedules, creating or changing event types, canceling or rescheduling bookings, confirming pending bookings, and modifying availability. The exact scope depen ...[truncated 92 chars]

Remediation

View remediation

Remediation Suggestions

• Store the token in an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Linux Secret Service implementation.
• If file storage is unavoidable, create the containing directory with mode 0700 and the token file with mode 0600.
• Create the file atomically with restrictive permissions rather than writing it first and changing permissions afterward.
• Reject or warn about token files that are group-readable, world-readable, or owned by another user.
• Ensure auth show redacts the token by default and never includes it in JSON output, logs, diagnostics, or shell history.
• Document token revocation, rotation, and secure removal procedures.
• Encourage narrowly scoped, short-lived tokens where Cal.com supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The skill includes curl -fsSL https://bun.sh/install | bash, which fetches a remote script and executes it immediately without verification. This is a classic remote code execution and supply-chain risk: if the endpoint, transport, or served script is compromised, arbitrary commands run with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

If calcom-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle calcom
npx api2cli link calcom

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash pattern chains network retrieval directly into shell execution, eliminating any opportunity for inspection or integrity verification. In this skill, that danger is amplified because the command is presented as a setup prerequisite, making users more likely to run it verbatim.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

If calcom-cli is not found, install and build it:

bash

bun --version || curl -fsSL https://bun.sh/install | bash
npx api2cli bundle calcom
npx api2cli link calcom

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger description includes broad terms like 'scheduling' and 'bookings', which may cause the skill to activate for generic calendar requests not explicitly intended for Cal.com. In context, this is risky because the skill supports authenticated and destructive operations against a real external service, increasing the chance of unintended API actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill advertises destructive operations such as deleting schedules and canceling/rescheduling bookings without warning about side effects or recommending user confirmation. In a calendar-management context, unintended mutations can disrupt meetings, availability, and business workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs users to execute npx api2cli install Melvynx/calcom-cli without pinning an exact package version or immutable source reference. This creates a supply-chain risk where a future compromised or malicious package version could be fetched and executed in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

npx api2cli bundle calcom invokes a non-pinned tool version, so the behavior and code executed can change over time. In a skill that encourages installation/build steps, this materially increases supply-chain exposure because agents or users may run newly published code without review.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

npx api2cli link calcom again depends on an unpinned package/toolchain and modifies local execution paths by linking binaries. If the upstream package is compromised, this can persist unsafe tooling into the user's PATH and affect later commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The authentication section tells users to store an API token locally in a predictable plaintext path without any credential-handling or privacy warning. This increases the risk of token disclosure through local compromise, backups, shared systems, or accidental exfiltration by other tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.