Security audit

Schedule Manager

Security checks for vulnerabilities and agentic risk

Overview

This schedule skill is mostly purpose-aligned, but it gives agents direct access to create, modify, and delete Calendar and Reminders data with weak safeguards around destructive actions.

Install only if you are comfortable granting the invoking terminal access to your Calendar and Reminders. Before allowing delete, complete, or bulk planning actions, ask the agent to show the exact matching items and require explicit confirmation. Consider avoiding the third-party reminders-cli dependency unless you trust its source, and inspect any Homebrew installer command before running it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/check_dependencies.sh:36
Finding: Unpinned Remote Installer Piped Directly to Bash<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check_dependencies.sh:36` **Vulnerability Type**: Remote code retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash echo " Install: /bin/bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)\"" ``` ### Technical Analysis The dependency checker prints a command that downloads the mutable `HEAD` revision of Homebrew's installation script and immediately passes it to Bash. The checker does not execute the command automatically, but it presents it as a copy-and-paste installation instruction. The downloaded content is not pinned to a reviewed commit and is not authenticated through a checksum or signature. Consequently, the effective code executed by a user can change after the Skill has been reviewed. HTTPS protects transport integrity but does not protect against compromise of the upstream repository, maintainer account, or release process. This behavior is not required for dependency detection. The script can report that Homebrew is unavailable and direct users to official documentation without creating a remote-code execution pipeline. ### Attack Path 1. Homebrew is absent from the target system. 2. The user runs `scripts/check_dependencies.sh`. 3. The script displays the `curl | bash` installation instruction. 4. The upstream `HEAD/install.sh` content changes or is compromised after the Skill audit. 5. The user copies and executes the displayed command. 6. The current remote content executes locally without prior inspection or integrity verification. 7. The payload operates with the user's privileges and may obtain additional installation privileges if the user approves an authentication prompt. ### Impact Assessment A compromised installer can execute arbitrary commands with the invoking user's privileges. It could read or modify user-accessible files, alter shell configuration, install additional software, or establish persiste ...[truncated 320 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the executable copy-and-paste command with a link to Homebrew's official installation documentation. 2. Do not pipe downloaded content directly into an interpreter. 3. If an automated installation path is necessary: - Pin the download to a reviewed immutable commit or release. - Download the file separately. - Verify a published cryptographic checksum or signature. - Allow the user to inspect the downloaded script. - Require explicit confirmation before execution. 4. Keep dependency-checking scripts read-only; they should detect and report missing software rather than facilitate mutable remote execution. 5. Document the expected files, directories, and privilege prompts associated with installation. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/check_dependencies.sh:16
Finding: Unpinned Security-Sensitive Dependency from a Third-Party Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `scripts/check_dependencies.sh:16-23` **Vulnerability Type**: Unpinned third-party supply-chain dependency **Risk Level**: Medium ### Vulnerable Code ```bash # Check reminders-cli (required for Reminders) echo "Checking reminders-cli..." if command -v reminders &> /dev/null; then version=$(reminders --version 2>&1 | head -1 || echo "installed") echo "✅ reminders-cli: OK ($version)" else echo "❌ reminders-cli: Not installed (required)" echo " Install: brew install keith/formulae/reminders-cli" echo " Benefits: Much faster than osascript for Reminders" fi ``` The same unpinned installation command is also documented in `SKILL.md` and `references/reminders-cli-guide.md`. ### Technical Analysis The Skill directs users to install `reminders-cli` from the third-party `keith/formulae` Homebrew tap without pinning a package version, formula revision, source commit, or checksum. The dependency is security-sensitive because the Skill instructs users to grant it access to Apple Reminders. A compromised maintainer account, tap repository, release artifact, or upstream distribution process could cause future installations to retrieve attacker-controlled code. Version validation is performed only after installation and does not establish artifact integrity or provenance. The dependency is functionally relevant, but using an unpinned personal tap exceeds the minimum supply-chain trust necessary unless its provenance and integrity are independently verified. ### Attack Path 1. An attacker compromises the third-party tap, its maintainer account, an upstream release, or a referenced artifact. 2. The attacker publishes a modified formula or package under the expected `reminders-cli` name. 3. A user follows the Skill's `brew install keith/formulae/reminders-cli` instruction. 4. Homebrew retrieves and installs the attacker-controlled content. 5. Malicious installation logic executes under the us ...[truncated 746 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a dependency distributed through a trusted, centrally reviewed package source. 2. Pin the dependency to a reviewed release or immutable source commit. 3. Verify the formula and downloaded artifact against a documented cryptographic checksum or signature. 4. Document the exact upstream repository and expected publisher identity. 5. Warn users that the installed binary receives access to private Reminders data. 6. Validate the installed binary's version and provenance before use; do not rely only on `command -v`. 7. Where practical, use the built-in `osascript` fallback so users can avoid installing a third-party binary, particularly for low-frequency operations. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:108
Finding: Calendar Deletion Uses a Non-Unique Title and Can Remove Multiple Events<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:108-114` **Vulnerability Type**: Overbroad destructive operation **Risk Level**: Medium ### Vulnerable Code ```bash osascript -e ' tell application "Calendar" tell calendar "个人" delete (every event whose summary is "要删除的事件名") end tell end tell' ``` An equivalent deletion example appears in `references/osascript-calendar.md:169-175`. ### Technical Analysis The documented AppleScript deletes every event in the selected calendar whose summary equals the supplied title. Calendar summaries are not unique identifiers, so several unrelated events can legitimately share the same title. The operation does not constrain matches by event identifier, date, time, recurrence status, or other distinguishing attributes. The workflow also does not document a mandatory preview or explicit confirmation before deletion. If an agent substitutes user-provided text into this pattern, an ambiguous request involving a common event title can delete more records than intended. The principal issue is overbroad selection rather than command injection. ### Attack Path 1. The Calendar permission required by the Skill has been granted. 2. A user or untrusted task description asks the agent to delete an event with a common title, such as a recurring meeting name. 3. The agent follows the documented deletion pattern. 4. AppleScript selects every event with that summary in the specified calendar. 5. All matching events are deleted without presenting the complete match set or requiring confirmation. 6. If the calendar is synchronized, the deletions may propagate to the user's other devices or connected calendar service. ### Impact Assessment The operation can delete multiple Calendar events within the selected calendar, including unrelated events that happen to share the same title. The deletion scope is bounded by the calendar named in the command and by the Calendar access granted to the invoking applicat ...[truncated 203 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Query matching events before performing any deletion. 2. Display each candidate's calendar, title, start time, end time, recurrence status, and unique identifier. 3. Require the user to select a specific candidate and explicitly confirm the destructive action. 4. Delete by a stable unique event identifier where supported. 5. If identifier-based deletion is unavailable, constrain the query using the calendar, exact start and end times, and other distinguishing properties. 6. Never use `delete (every event ...)` for a single-event request. 7. Treat recurring events separately and ask whether the user intends to delete one occurrence or the entire series. 8. Add error handling and report exactly which event was deleted. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

High

Confidence: 98% confidence
Finding: The trigger phrases are broad everyday language such as ‘记一下’, ‘别忘了’, ‘todo’, and ‘schedule’, which can cause the skill to activate in contexts where the user did not intend calendar or reminder actions. Because the skill performs real shell-backed reads and writes to Calendar and Reminders, accidental activation can lead to unintended data creation, modification, or disclosure.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill invokes shell-capable tools (`osascript`, `reminders-cli`) but does not declare an explicit tool scope such as `permissions` or `allowed-tools`. That makes execution boundaries ambiguous and increases the risk of unintended command execution or overbroad agent authority when the skill is triggered.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents destructive delete operations for calendar events without an adjacent warning, confirmation requirement, or safe targeting guidance. The example deletes every event whose summary matches a string, which can remove multiple items at once and cause irreversible user data loss if used imprecisely.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document provides a direct example for deleting an entire calendar without any warning, confirmation step, or emphasis that the action permanently removes calendar data. In a skill designed to manage schedules via osascript, this increases the chance that an agent or user will reuse the example in an unsafe way and cause destructive data loss.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The event deletion examples show bulk deletion by title or date range but omit any warning that all matching events will be permanently removed. In the context of an automation skill that triggers on natural-language scheduling requests, ambiguous matching or accidental invocation could delete multiple legitimate events and cause meaningful data loss.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document includes a direct list deletion example with no warning, confirmation step, or guidance about irreversible data loss. In a skill designed to automate Reminders actions, this omission increases the chance that an agent or user applies the command to real data without understanding the destructive consequence.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The reminder deletion examples demonstrate permanent removal of reminders, including completed items, without cautionary language or safeguards. Because this skill targets task and schedule management, an agent may operationalize these snippets against a user's live reminders, causing unintended loss of productivity data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The bulk completion example modifies many reminders in one operation without warning about mass state changes or how to verify the selection. In the context of a GTD/calendar management skill, this can silently alter a large portion of a user's task system and undermine trust, accuracy, and downstream planning.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guide explicitly documents state-changing and destructive commands such as completing, uncompleting, and deleting reminders without any caution that they modify or permanently remove user data. In this skill context, the agent is intended to manage Apple Reminders directly, so undocumented destructive operations increase the risk of accidental data loss or unsafe automation when the model follows the reference blindly.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The cross-project planning workflow instructs the agent to scan `~/code/*/planning/schedules/*.yaml`, which may expose project names, timelines, and capacity data across repositories without clearly warning the user or requesting consent. Even though the path is limited, this is still local file discovery and aggregation of potentially sensitive planning information.

Static analysis

No suspicious patterns detected.