Security audit

appointment-scheduler

Security checks across malware telemetry and agentic risk

Overview

This scheduler is mostly purpose-aligned, but it needs Review because it combines customer data, automated messaging, Google Calendar access, and a confirmed command-injection weakness.

Install only if you are comfortable reviewing and fixing the unsafe shell call, protecting Google OAuth files, and managing customer consent. Before using it with real customers, restrict token file permissions, avoid storing sensitive notes or health-related details, configure retention/deletion practices, confirm outbound reminders are opt-in, and verify timezone/calendar fields for your business.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly shows collecting customer names and phone numbers, then using those details for automated reminders and waitlist notifications, but it does not mention consent, retention limits, or privacy safeguards. In an appointment-booking skill for salons/clinics/studios, this omission increases the chance of unauthorized processing of personal data and accidental disclosure through automated messaging workflows.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation instructs users to store Google Calendar OAuth credentials and tokens in predictable local secret-file paths, but provides no warning about file permissions, access restrictions, backup exposure, or secret rotation. If those files are readable by other local users, synced to cloud backups, or accidentally committed/copied, an attacker could gain persistent access to the connected Google Calendar account.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill handles customer names, phone numbers, booking details, and no-show history, but it does not present any explicit privacy notice, retention policy, or consent guidance. In a scheduling context, this can lead to collection and storage of personal data without informed user approval, increasing compliance and privacy risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill describes automatic reminders and waitlist notifications via SMS, DM, and messaging platforms without an explicit operator warning that it will send outbound customer communications. This creates risk of unauthorized messaging, consent violations, and accidental spam if enabled by default or triggered on incorrect customer data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The calendar integration section instructs users to configure OAuth credentials and sync booking data with external calendar services, but it does not clearly warn that customer appointment information will be transmitted to third-party providers. This increases the chance of unsafe deployment, overbroad token use, and unreviewed data sharing.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script copies and persists sensitive customer contact data (name, phone, email) into no-show history and flagged-customer files in plaintext under a workspace directory, increasing exposure and retention of personal data beyond what is necessary to mark attendance. If those files are accessed by other local users, tools, backups, or logs, customer PII can be disclosed and used for profiling or unfair treatment, especially because the skill context involves real appointment customers.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script uploads personally identifiable appointment data, including customer names, phone numbers, and notes, to Google Calendar without any explicit consent flow, warning, or data-minimization safeguard. In the context of a salon/clinic scheduler, this can expose sensitive customer information to a third-party service and to anyone with access to the linked calendar.

Natural-Language Policy Violations

Medium

Confidence: 85% confidence
Finding: The event content and timezone are hard-coded to Korean text and Asia/Seoul, which can cause incorrect appointment times, confusing reminders, and accidental disclosure or mishandling of booking details in deployments outside that locale. In scheduling systems, timezone mistakes directly affect availability and attendance, so this is an integrity and privacy risk rather than just a localization bug.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/cancel-booking.js:58