T09 · Insecure Skill Coding Practices
Error
- Location
scripts/caldav.py:114- Finding
Apple credentials can be disclosed to untrusted server-provided hosts
- Content
View full analysis
- Remediation
View remediation
Security audit
iCloud CalDav
Security checks for vulnerabilities and agentic risk
Overview
This iCloud Calendar skill is mostly purpose-aligned, but it handles Apple credentials and destructive calendar deletions with insufficient safeguards.
Review this skill before installing. Use a revocable Apple app-specific password, avoid delete operations unless you have verified the exact event target, and prefer a version that validates Apple CalDAV hostnames, restricts deletion filenames to safe .ics basenames, parses UID values exactly, and confirms destructive actions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/caldav.py:385- Finding
Path traversal in filename-based event deletion can target unintended resources
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/caldav.py:397- Finding
Substring-based UID matching can delete the wrong calendar event
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The code aligns closely with the stated iCloud Calendar/CalDAV purpose and correctly uses direct CalDAV access with Apple credentials. It supports reading calendars/events, creating events, and deleting events. However, the description explicitly claims create, read, update, and delete functionality, while the code only implements create, read, and delete; there is no event update/edit operation. Additionally, the description mentions using it to 'find free time' or manage schedule, but the code only lists events within a date range and does not compute availability or free-time slots. Because a declared core capability (update) is missing, this is a description-behavior mismatch.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./scripts/caldav.py list-calendars
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Delete Event
text DELETE /12345678/calendars/CalendarName/event-uuid.icsiCalendar (ICS) Format
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requires access to environment variables for Apple credentials and network access to Apple's CalDAV endpoint, but it does not explicitly declare any tool scope or permissions. This creates an authorization ambiguity where a host agent may grant broader capabilities than intended, making credential access and outbound network use insufficiently constrained.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file includes concrete instructions for PUT and DELETE requests that create, overwrite, and remove calendar events. Under the markdown-specific warning criterion, the description omits any caution that these actions affect user data and may overwrite or permanently delete calendar entries.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The fallback ICS generator hard-codes DTSTART/DTEND with TZID=Asia/Shanghai, regardless of the user's actual timezone or input semantics. This can silently create events at the wrong time, causing missed meetings or unintended scheduling actions; in a calendar-management skill, that operational integrity issue is security-relevant because it can alter user data incorrectly.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The manifest describes an iCloud Calendar integration for managing events, but does not mention reading secrets from the runtime environment. Accessing environment variables is a separate sensitive capability that goes beyond direct calendar operations, even if used here for authentication.
- Content
Static analysis
No suspicious patterns detected.