Calendar

Calendar management and scheduling. Create events, manage meetings, and sync across calendar providers.

Security Scan

The skill claims full calendar integrations (Google/Apple/Outlook) but provides no authentication, no runtime instructions, and requests unrelated binaries, so its declared capabilities and requirements don't align.

Purpose & Capability

The SKILL.md claims support for Google, Apple, and Outlook calendars and features like sync and schedule creation, but the skill requests no credentials, tokens, config paths, or explanation of how it will access those providers. A calendar integrator would normally require OAuth credentials, API keys, or platform-specific connectors; those are missing. Additionally, the metadata lists required binaries (curl, jq) yet the instructions include no concrete commands that would use them.

Instruction Scope

The runtime instructions are very high-level and contain only feature descriptions and usage examples; there are no concrete runtime steps, commands, or guidance on where credentials or tokens come from. That makes the skill vague and grants broad unspecified discretion to the agent, but does not itself instruct any risky actions (no file reads, no network endpoints, etc.).

Install Mechanism

This is an instruction-only skill with no install spec and no code files. That minimizes installation risk (nothing is downloaded or written to disk).

Credentials

No environment variables, config paths, or primary credential are declared despite the need for provider authentication implied by the description. The lack of declared credentials is disproportionate to the claimed functionality. Also, the required binaries (curl, jq) are listed even though the SKILL.md contains no instructions that would use them.

Persistence & Privilege

The skill is not marked always:true and requests no persistent system changes or access to other skills' configurations. It does not appear to require elevated persistence or privileges.

What to consider before installing

This skill is ambiguous rather than overtly malicious, but it has unexplained gaps. Before installing or enabling it: 1) Ask the author how authentication to Google/Apple/Outlook is handled (OAuth flow, where tokens are stored, required env vars). 2) Verify why curl and jq are listed as required and request concrete runtime examples or commands that will run. 3) Confirm the publisher/owner (the _meta.json ownerId differs from registry metadata) and prefer skills with a verifiable homepage or source. 4) If you plan to give it calendar access, test it in a low-privilege or sandboxed environment first and avoid supplying permanent high-privilege credentials until you understand the auth flow. If the developer cannot justify the missing auth/config details, treat the skill as unsafe to enable for access to your calendars.

Calendar and scheduling management.

Features

• Create events
• Schedule meetings
• Set reminders
• View availability
• Recurring events
• Calendar sync

Supported Providers

• Google Calendar
• Apple Calendar
• Outlook Calendar

Usage Examples

"Schedule meeting tomorrow at 2pm"
"Show my calendar for this week"
"Find free time for a 1-hour meeting"