Security audit
Security checks for vulnerabilities and agentic risk
This is a simple calendar-management skill whose sensitive calendar actions are visible in its stated purpose, with no hidden code, persistence, or exfiltration behavior found.
Before installing, treat this as a skill that may help an agent read or change calendar information if connected to providers. Use it only with accounts you intend to manage, and confirm event creation, edits, deletion, or cross-provider sync before letting an agent act.
The skill description is broad enough that an assistant could invoke it from common scheduling-related requests without clear boundaries or confirmation. Because this skill can access and potentially modify sensitive calendar data across providers, over-broad activation increases the risk of unintended data access or event creation.
The skill advertises calendar management and cross-provider sync but does not warn users that it may access sensitive availability, attendee, and event metadata across multiple calendar services. Missing disclosure and consent language is especially dangerous here because calendar contents often reveal personal routines, business meetings, locations, and relationships.
The usage examples are natural everyday phrases that are likely to overlap with ordinary conversation, making accidental invocation more likely. In a calendar skill, that can expose schedule data or cause unwanted meeting-related actions if the system routes based on loose phrase matching.
No suspicious patterns detected.
