ClawHub
Back to skill

Security audit

Calendar Sync

Security checks across malware telemetry and agentic risk

Overview

The skill’s calendar-sync purpose is coherent, but its direct Apple Calendar mode builds executable AppleScript from document fields and can persist sensitive document details in calendar entries.

Prefer the ICS workflow and inspect the generated events before importing. Avoid direct AppleScript mode unless the structured JSON comes from a trusted source, and redact sensitive notes such as amounts, file paths, names, Notion links, and document IDs before syncing to any calendar that may be shared or backed up.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
'''

        try:
            result = subprocess.run(
                ['osascript', '-e', script],
                capture_output=True, text=True, timeout=10
            )
Confidence
95% confidence
Finding
result = subprocess.run( ['osascript', '-e', script], capture_output=True, text=True, timeout=10 )

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions, but its documented behavior includes reading document content/file paths and invoking AppleScript or shell-based mechanisms (`osascript`, Python ICS generation), which are code-capable operations. This mismatch can cause the runtime or reviewer to underestimate what the skill can access or execute, increasing the risk of unauthorized file exposure or command execution pathways if later automation blindly trusts the manifest.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
system-prompt.md:1