Calendar

Manage Google Calendar events using `gcalcli`. Create, list, and delete calendar events from the CLI.

Security Scan

The skill's stated purpose (using gcalcli to manage calendars) is reasonable, but its runtime instructions reference sensitive credentials (Google API key or CalDAV user/password) that are not declared in the skill metadata — an inconsistency that should be resolved before trusting it.

Purpose & Capability

Name/description match the actual behavior (gcalcli CLI calls). Requiring the gcalcli binary and providing a pip install for gcalcli is proportionate to the stated purpose. However, the SKILL.md mentions needing GOOGLE_CALENDAR_API_KEY or CALDAV_URL/CALDAV_USER/CALDAV_PASS while the skill metadata lists no required environment variables or credentials — this mismatch is unexpected.

Instruction Scope

SKILL.md contains concrete gcalcli commands (agenda, add, delete) which stay within calendar management. But it explicitly refers to API keys/CALDAV credentials as required inputs; those credentials are sensitive and the instructions do not say how they are supplied or stored. The instructions give broad examples but do not constrain where credentials come from, which increases the risk if an agent is given access to environment/config.

Install Mechanism

Install is a straightforward pip install gcalcli which is expected for this tool. pip installs are common and reasonable here, but they carry the usual supply-chain risk of installing packages from PyPI. No obscure or remote download URLs are used.

Credentials

The skill metadata declares no required environment variables, yet SKILL.md explicitly references GOOGLE_CALENDAR_API_KEY or CALDAV_URL/CALDAV_USER/CALDAV_PASS. Sensitive variables (API keys, usernames, passwords) are implied but not declared as required — this is a red flag because the agent or user might be asked to provide or expose secrets without clear metadata or provenance.

Persistence & Privilege

The skill does not request always:true and does not claim to modify other skills or global agent config. Agent autonomous invocation is allowed (the platform default) but that by itself is expected for typical skills.

What to consider before installing

Before installing, ask the publisher to update the skill metadata to declare exactly which credentials it needs (GOOGLE_CALENDAR_API_KEY, or CALDAV_* variables) and how those credentials are used/stored. Verify the source of the skill (there is no homepage or repository listed) and prefer installing gcalcli yourself rather than having the agent run pip automatically. Be cautious about giving the agent access to environment variables or config files that contain API keys or passwords; if you must use this skill, store credentials in a secure place (not a shared env) and run the skill in a sandboxed account. Finally, confirm how gcalcli will authenticate (OAuth client files, token cache like ~/.gcalcli_oauth, or plain API keys) so you know where secrets will live on disk.

Calendar Skill

Use gcalcli to interact with Google Calendar. Requires GOOGLE_CALENDAR_API_KEY (or CALDAV_URL/CALDAV_USER/CALDAV_PASS for CalDAV).

Listing Events

List upcoming events in a date range:

gcalcli agenda "2026-02-03" "2026-02-10"

Creating Events

Add a new calendar event:

gcalcli add --title "Team sync" --when "2026-02-04 10:00" --duration 30

Deleting Events

Delete an event by search term:

gcalcli delete "Team sync"

Install

pip install gcalcli