PortEden - secured calendar(Gmail, Outlook, Exchange) access for OpenClaw

Secured Calendar management - Google Calendar, Microsoft Outlook & Exchange - list, search, create, update, delete, and respond to calendar events across mul...

Security Scan

The skill's requirements and runtime instructions are coherent with a calendar-management CLI: it needs the porteden binary and a PE_API_KEY and instructs the agent to call that CLI — nothing in the package indicates it is trying to do unrelated or hidden work.

Purpose & Capability

Name/description, declared binary requirement (porteden), install instructions (brew/go) and primaryEnv (PE_API_KEY) all align with a CLI-based calendar integration. Requesting a PE_API_KEY and a local 'porteden' binary is proportionate to the stated purpose.

Instruction Scope

SKILL.md contains only CLI usage for porteden (listing, searching, creating, updating, deleting events) and instructions to authenticate via browser or token. It explicitly notes credentials persist in the system keyring and recommends using PE_API_KEY in the environment. One minor inconsistency: SKILL.md references additional optional env vars (PE_PROFILE, PE_TIMEZONE, PE_FORMAT, PE_COLOR, PE_VERBOSE) that are not declared in the registry's requires.env list — this is informational but not malicious. No instructions request unrelated files, system-wide config, or external endpoints beyond the porteden CLI behavior.

Install Mechanism

Install options are brew (porteden/tap/porteden) or go install from github.com/porteden/cli — both are normal package install paths for a CLI. There are no arbitrary URL downloads or extract-from-unknown-host steps in the manifest. Note: the brew tap is a third-party tap (porteden/tap) rather than Homebrew/core; verify you trust that tap if installing via brew.

Credentials

Only one required credential (PE_API_KEY) is declared and used as the primary credential, which is appropriate. SKILL.md mentions additional optional env vars for convenience but does not require unrelated credentials. The CLI persists credentials to the system keyring — expected for a CLI but worth noting because it creates local persistent access to calendar accounts.

Persistence & Privilege

The skill is not force-included (always:false) and does not request elevated privileges or modify other skills. It relies on a local CLI which stores tokens in the system keyring (local persistence) — normal for this type of tool. Autonomous invocation is allowed (platform default); if you enable the skill for autonomous actions, the agent will be able to run the porteden CLI and access any credentials available to it.

Assessment

This skill is coherent: it simply directs the agent to run the porteden CLI and use PE_API_KEY or an interactive/browser login. Before installing, verify you trust the PortEden project and the brew tap or GitHub repo used for go install. Understand that PE_API_KEY grants access to your calendars — consider creating a least-privilege API key or a dedicated profile, and avoid putting long-lived keys in global shells. Note that the CLI stores credentials in the system keyring (persistent local access); if you are concerned about persistence, prefer temporary tokens and remove them after use. Finally, if you plan to allow autonomous agent actions, remember the agent will be able to run the CLI and read/write calendar events, so review access and consent settings accordingly.

porteden

Use porteden for calendar management across multiple accounts. Use -jc flags for AI-optimized output.

If porteden is not installed: brew install porteden/tap/porteden (or go install github.com/porteden/cli/cmd/porteden@latest).

Setup (once)

• Browser login (recommended): porteden auth login — opens browser, credentials stored in system keyring
• Direct token: porteden auth login --token <key> — stored in system keyring
• Verify: porteden auth status
• If PE_API_KEY is set in the environment, the CLI uses it automatically (no login needed).

Common commands

• List calendars: porteden calendar calendars -jc
• Events today (or --tomorrow, --week): porteden calendar events --today -jc
• Events custom range: porteden calendar events --from 2026-02-01 --to 2026-02-07 -jc
• All events (auto-pagination): porteden calendar events --week --all -jc
• Search events: porteden calendar events -q "meeting" --today -jc
• Events by contact: porteden calendar by-contact "[e-mail]" -jc (or --name "John Smith")
• Get single event: porteden calendar event <eventId> -jc
• Create event: porteden calendar create --calendar <id> --summary "Meeting" --from "..." --to "..." --location "Room A" --attendees "[e-mail],[e-mail]"
• Update event: porteden calendar update <eventId> --summary "New Title" (also: --from, --to, --location)
• Update attendees: porteden calendar update <eventId> --add-attendees "[e-mail]" (or --remove-attendees; add --notify to send notifications)
• Delete event: porteden calendar delete <eventId> (add --no-notify to skip attendee notifications)
• Respond to invite: porteden calendar respond <eventId> accepted (or: declined, tentative)

Event Status Values

• confirmed - Accepted/scheduled
• tentative - Maybe attending
• needsAction - Requires response from user
• cancelled - Event was cancelled

Time Formats

• All times use RFC3339 UTC format: 2026-02-01T10:00:00Z
• For all-day events, use midnight-to-midnight with --all-day flag
• JSON output includes startUtc, endUtc, durationMinutes fields

Notes

• Credentials persist in the system keyring after login. No repeated auth needed.
• Set PE_PROFILE=work to avoid repeating --profile.
• -jc is shorthand for --json --compact: filters noise, truncates descriptions, limits attendees, reduces tokens.
• Use --all to auto-fetch all pages; check meta.hasMore and meta.totalCount in JSON output.
• Manual pagination: --limit 100 --offset 0, then --offset 100, etc.
• by-contact supports partial matching: "@acme.com" for email domain, --name "Smith" for name.
• Confirm before creating, updating, or deleting events.
• "invalid calendar ID": Get IDs with porteden calendar calendars -jc.
• Environment variables: PE_API_KEY, PE_PROFILE, PE_TIMEZONE, PE_FORMAT, PE_COLOR, PE_VERBOSE.