Calendar Sync

Calendar synchronization skill. Sync events between Google Calendar, Outlook, and local storage. Supports CRUD operations and reminders.

Security Scan

The skill's instructions claim to sync Google and Outlook calendars and reference OAuth credentials and local Python scripts, but the package provides no code, no declared required environment variables, and no install steps — the pieces don't line up.

Purpose & Capability

The name/description state it will sync Google Calendar and Outlook, and the SKILL.md includes environment variables and CLI usage for that purpose. However, the registry metadata declares no required credentials or config, and there are no code files or binaries included to perform the described sync. The skill therefore claims capabilities that it does not actually provide.

Instruction Scope

Runtime instructions explicitly tell the operator/agent to export OAuth client IDs/secrets and to run 'python3 scripts/calendar.py' commands. But no 'scripts/' files are bundled and the SKILL.md gives no safe guidance for performing OAuth flows or handling tokens. The instructions require sensitive secrets (client secret) and expect a local callback URL, which could cause the agent or user to open network listeners — this scope is not covered by the registry metadata and is underspecified.

Install Mechanism

There is no install spec (instruction-only), which is lowest install risk. However, because the skill references local scripts that are not present, it's ambiguous whether the author intended the skill to rely on preexisting local tooling or omitted code — that mismatch is concerning from a usability and security perspective.

Credentials

SKILL.md instructs setting GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REDIRECT_URI, OUTLOOK_CLIENT_ID, and OUTLOOK_CLIENT_SECRET — sensitive secrets — but the registry metadata lists no required environment variables or primary credential. Requiring OAuth client secrets is reasonable for calendar sync, but the metadata should declare them and the instructions should describe secure handling; the current mismatch and lack of bundled code increases risk of accidental secret exposure.

Persistence & Privilege

The skill does not request 'always: true' nor any special platform-wide persistence. It is user-invocable and allows autonomous invocation by default (normal). There is no indication it modifies other skills or system config.

What to consider before installing

This skill is inconsistent: it promises Google/Outlook calendar sync but contains no scripts or install steps and the registry metadata does not declare the OAuth environment variables the SKILL.md asks you to set. Before installing or using it, ask the publisher for the missing source code and a clear install/usage guide; require that the skill's metadata list the OAuth credentials it needs. Never paste real client secrets into an unknown skill; if you test, use throwaway accounts and rotate credentials afterward. If you need calendar sync functionality now, prefer a skill that includes code or a verified upstream source (homepage/repo) and that explicitly declares required env vars and OAuth flow details.

Synchronize calendar events across Google Calendar, Outlook, and local storage.

When to Use

• User wants to add/edit/delete calendar events
• Sync events between different calendar providers
• Set up reminders and recurring events
• Check availability and schedule meetings

Configuration

# Google Calendar
export GOOGLE_CLIENT_ID="xxx"
export GOOGLE_CLIENT_SECRET="xxx"
export GOOGLE_REDIRECT_URI="http://localhost:8080/callback"

# Microsoft Outlook
export OUTLOOK_CLIENT_ID="xxx"
export OUTLOOK_CLIENT_SECRET="xxx"

Usage

List events

python3 scripts/calendar.py list --days 7

Add event

python3 scripts/calendar.py add \
  --title "Team Meeting" \
  --start "2024-01-15T10:00:00" \
  --end "2024-01-15T11:00:00" \
  --description "Weekly sync" \
  --reminder 15

Delete event

python3 scripts/calendar.py delete --event-id "xxx"

Check availability

python3 scripts/calendar.py available \
  --date "2024-01-15" \
  --duration 60

Output

{
  "success": true,
  "event_id": "evt_xxx",
  "calendar_link": "https://calendar.google.com/..."
}