Security audit

Calendar Extractor

Security checks across malware telemetry and agentic risk

Overview

This calendar skill does what it says, but it automatically receives and processes sensitive voice and keyboard transcripts very broadly before a user explicitly asks each time.

Install only if you are comfortable with a HiJavis skill receiving completed voice and keyboard transcript units automatically, extracting possible calendar events, and writing pending event records/cards to the HiJavis server. Review the app's privacy controls, transcript retention, scheduled-summary settings, and how to disable the skill before enabling it in sensitive personal or workplace environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The invocation phrases are generic enough to collide with normal conversation, increasing the chance the skill triggers when a user did not clearly intend to invoke it. In a skill that scans recent recordings and surfaces extracted events, unintended invocation can expose sensitive scheduling information or cause background processing the user did not expect.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The README describes continuous listening, scanning recent recordings, and scheduled summaries, but does not provide a clear privacy notice explaining what data is collected, retained, processed, or shared. For a skill handling conversation content and inferred calendar details, this omission can lead to uninformed consent, unexpected exposure of sensitive personal or business information, and unsafe deployment in privacy-sensitive contexts.

Vague Triggers

High

Confidence: 97% confidence
Finding: The skill is explicitly configured to be invoked automatically for every completed unit, with relevance decided by the skill itself after it has already received transcript content. That creates an overly broad collection-and-processing path for sensitive audio/keyboard transcripts without a narrow trigger boundary, increasing the chance of unintended surveillance-like behavior and unnecessary extraction of private scheduling data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The route match terms include broad everyday concepts like meetings, events, agenda, and dates/times mentioned, which can overlap with many benign conversations. In a transcript-processing skill, ambiguous routing raises the likelihood that unrelated personal conversations will still be analyzed and converted into calendar artifacts.

Vague Triggers

High

Confidence: 95% confidence
Finding: The 'When to use' section normalizes unconditional automatic invocation and says the skill decides for itself whether to act, meaning transcripts are still presented to the skill before user-scoped relevance is established. This expands the attack surface for privacy-invasive processing and makes accidental collection more likely in routine use.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The auto-run design processes prompt-embedded transcript content and may transmit extracted event data to server endpoints without a prominent user warning at the point of use. Because this involves sensitive transcript collection from audio and keyboard input, the lack of clear disclosure and consent language materially increases privacy and compliance risk.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The package description explicitly states the skill is invoked by the dispatcher for every completed unit, with no classifier or route matching, and that the skill decides relevance itself. This broad invocation model weakens trigger-based access control and can cause the skill to process unrelated user content by default, increasing the chance of unnecessary transcript access, privacy overreach, and unintended downstream actions such as event extraction and message pushing.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to always use prompt-embedded UNIT CONTEXT transcripts as the source of truth and to continue extracting and pushing even if fetch fails. This creates a natural-language data ingestion path that bypasses normal retrieval boundaries and ensures sensitive transcript data is still processed in auto-runs, even when backing data has been removed or is unavailable.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/data.test.js:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/calendar-extractor.js:78