Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Cal.com automation guide whose sensitive actions are visible and aligned with scheduling administration.
Install this only if you intend to let an agent operate your Cal.com account through Rube MCP. Review actions before creating bookings, teams, or changing webhooks, and only point webhooks at HTTPS endpoints you control or trust because booking-event data may be delivered there.
The webhook guidance instructs users how to configure external subscriber URLs but does not warn that booking events and related metadata will be transmitted to third-party endpoints. In a scheduling context, webhook payloads may contain personal or sensitive business information, so omission of this warning can lead to unintended data disclosure to external systems.
The skill documents webhook deletion as a routine operation without clearly warning that deletion is destructive and may permanently stop downstream automations, notifications, or audit-relevant integrations. In operational environments, a user or agent following these instructions could unintentionally disrupt business workflows or incident monitoring.
The manifest description scopes the skill to managing bookings, checking availability, configuring webhooks, and handling teams. However, the file also defines a separate 'Organization Management' workflow using CAL_GET_ORGANIZATION_ID, which extends beyond the enumerated capabilities in the description.
No suspicious patterns detected.
