Security audit

Schedule Manager

Security checks for vulnerabilities and agentic risk

Overview

This schedule skill is mostly purpose-aligned, but it gives agents direct access to create, modify, and delete Calendar and Reminders data with weak safeguards around destructive actions.

Install only if you are comfortable granting the invoking terminal access to your Calendar and Reminders. Before allowing delete, complete, or bulk planning actions, ask the agent to show the exact matching items and require explicit confirmation. Consider avoiding the third-party reminders-cli dependency unless you trust its source, and inspect any Homebrew installer command before running it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/check_dependencies.sh:36
Finding: Unpinned Remote Installer Piped Directly to Bash
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/check_dependencies.sh:16
Finding: Unpinned Security-Sensitive Dependency from a Third-Party Homebrew Tap
Content: View full analysis
/dev/null; then version=$(reminders --version 2>&1 | head -1 || echo "installed") echo "✅ reminders-cli: OK ($version)" else echo "❌ reminders-cli: Not installed (required)" echo " Install: brew install keith/formulae/reminders-cli" echo " Benefits: Much faster than osascript for Reminders" fi ``` The same unpinned installation command is also documented in `SKILL.md` and `references/reminders-cli-guide.md`. ### Technical Analysis The Skill directs users to install `reminders-cli` from the third-party `keith/formulae` Homebrew tap without pinning a package version, formula revision, source commit, or checksum. The dependency is security-sensitive because the Skill instructs users to grant it access to Apple Reminders. A compromised maintainer account, tap repository, release artifact, or upstream distribution process could cause future installations to retrieve attacker-controlled code. Version validation is performed only after installation and does not establish artifact integrity or provenance. The dependency is functionally relevant, but using an unpinned personal tap exceeds the minimum supply-chain trust necessary unless its provenance and integrity are independently verified. ### Attack Path 1. An attacker compromises the third-party tap, its maintainer account, an upstream release, or a referenced artifact. 2. The attacker publishes a modified formula or package under the expected `reminders-cli` name. 3. A user follows the Skill's `brew install keith/formulae/reminders-cli` instruction. 4. Homebrew retrieves and installs the attacker-controlled content. 5. Malicious installation logic executes under the us ...[truncated 746 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:108
Finding: Calendar Deletion Uses a Non-Unique Title and Can Remove Multiple Events
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger phrases are broad everyday language such as ‘记一下’, ‘别忘了’, ‘todo’, and ‘schedule’, which can cause the skill to activate in contexts where the user did not intend calendar or reminder actions. Because the skill performs real shell-backed reads and writes to Calendar and Reminders, accidental activation can lead to unintended data creation, modification, or disclosure.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill invokes shell-capable tools (osascript, reminders-cli) but does not declare an explicit tool scope such as permissions or allowed-tools. That makes execution boundaries ambiguous and increases the risk of unintended command execution or overbroad agent authority when the skill is triggered.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill documents destructive delete operations for calendar events without an adjacent warning, confirmation requirement, or safe targeting guidance. The example deletes every event whose summary matches a string, which can remove multiple items at once and cause irreversible user data loss if used imprecisely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document provides a direct example for deleting an entire calendar without any warning, confirmation step, or emphasis that the action permanently removes calendar data. In a skill designed to manage schedules via osascript, this increases the chance that an agent or user will reuse the example in an unsafe way and cause destructive data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The event deletion examples show bulk deletion by title or date range but omit any warning that all matching events will be permanently removed. In the context of an automation skill that triggers on natural-language scheduling requests, ambiguous matching or accidental invocation could delete multiple legitimate events and cause meaningful data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document includes a direct list deletion example with no warning, confirmation step, or guidance about irreversible data loss. In a skill designed to automate Reminders actions, this omission increases the chance that an agent or user applies the command to real data without understanding the destructive consequence.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The reminder deletion examples demonstrate permanent removal of reminders, including completed items, without cautionary language or safeguards. Because this skill targets task and schedule management, an agent may operationalize these snippets against a user's live reminders, causing unintended loss of productivity data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The bulk completion example modifies many reminders in one operation without warning about mass state changes or how to verify the selection. In the context of a GTD/calendar management skill, this can silently alter a large portion of a user's task system and undermine trust, accuracy, and downstream planning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide explicitly documents state-changing and destructive commands such as completing, uncompleting, and deleting reminders without any caution that they modify or permanently remove user data. In this skill context, the agent is intended to manage Apple Reminders directly, so undocumented destructive operations increase the risk of accidental data loss or unsafe automation when the model follows the reference blindly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The cross-project planning workflow instructs the agent to scan ~/code/*/planning/schedules/*.yaml, which may expose project names, timelines, and capacity data across repositories without clearly warning the user or requesting consent. Even though the path is limited, this is still local file discovery and aggregation of potentially sensitive planning information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.