Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a real calendar-extraction skill, but it needs Review because enabling it can automatically read voice and keyboard transcripts and push pending calendar items without a run-time approval gate.
Install only if you are comfortable with HiJavis automatically processing recent or embedded voice and keyboard transcripts when the skill is enabled, writing extracted events as pending calendar rows, and sending event cards to chat before you confirm them. Check the app's privacy, retention, and disable controls first.
Referenced artifact was not completely inspected
fier, no route matching. This skill's own agent decides for itself, using this `SKILL.md`, whether the unit is worth acting on; if not, it does nothing (see "Ho
Referenced artifact was not completely inspected
fier, no route matching. This skill's own agent decides for itself, using this `SKILL.md`, whether the unit is worth acting on; if not, it does nothing (see "Ho
The skill is configured to auto-run on every completed voice/keyboard unit and explicitly lets its own agent decide whether a transcript is 'worth acting on.' That creates broad, self-authorized access to sensitive transcript content and can trigger extraction/push behavior from ordinary conversations without an explicit user action at the time of processing.
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Referenced artifact was not completely inspected
node scripts/calendar-extractor.js fetch [--hours N] [--limit N]
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
try {
return readJson(p);
} catch (e) {
// A truncated/corrupt state file (e.g. a kill mid-write before the atomic
// rename landed, on an older volume) must not brick every future run.
// `seen` is best-effort dedup state, so start fresh.
console.error(`⚠️ state file unreadable, starting fresh: ${e.message}`);
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
test('sanitizeId rejects path-traversal userIds (exits non-zero)', () => {
for (const bad of ['../etc/passwd', '..', 'a/../../b', 'foo/bar']) {
const r = runGuard(`d.sanitizeId(${JSON.stringify(bad)})`);
assert.notEqual(r.status, 0, `"${bad}" must be rejected`);
assert.match(r.stderr, /Invalid userId/);
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
test('sanitizeId rejects path-traversal userIds (exits non-zero)', () => {
for (const bad of ['../etc/passwd', '..', 'a/../../b', 'foo/bar']) {
const r = runGuard(`d.sanitizeId(${JSON.stringify(bad)})`);
assert.notEqual(r.status, 0, `"${bad}" must be rejected`);
assert.match(r.stderr, /Invalid userId/);
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
try {
const tz = await resolveUserTz({ explicitTz: 'America/Los_Angeles' });
assert.equal(tz, 'America/Los_Angeles');
assert.equal(errs.length, 0, 'no warning when a real zone is found');
} finally {
console.error = origErr;
}
The README explicitly states that the app listens to conversations, scans recent recordings, and processes meetings, but it does not provide a clear privacy notice, consent model, retention policy, or disclosure about how sensitive audio and extracted event data are handled. Because this skill operates on inherently sensitive personal and third-party conversation data, the lack of prominent privacy and consent disclosures increases the risk of covert or overbroad collection and user misunderstanding.
The skill description advertises extraction and pushing behavior, but it does not present a prominent user warning about automatic background access to the last 24 hours of transcripts and delivery into iOS chat threads. Because the skill also supports dispatcher-driven automatic execution, insufficient disclosure materially raises privacy and surprise risks.
The route matching text uses generic concepts like meetings, appointments, events, agenda, and dates/times mentioned, which are common in normal conversation. In context, this increases the chance of unintended activation and processing of unrelated transcripts, causing privacy-invasive overcollection and accidental event creation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
# anchor — print the CURRENT relative-date anchor (resolve "today / 6 pm / tomorrow" on an edit turn)
node scripts/calendar-extractor.js anchor # optional: --tz <IANA> for the card's calendar zone
# update — edit ONE pushed card in place (verbatim dedup_key, full merged patch, auto-confirm)
echo '{"dedup_key":"<verbatim>","patch":{...}}' | node scripts/calendar-extractor.js update
# Optional: explicit userId / multi-profile (back-compat — prepend the ID)
Detected: suspicious.dangerous_exec, suspicious.env_credential_access