Trip Calendar

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:27 AM UTC
• Version: 1.0.0

Overview

This skill has a clear travel-calendar purpose, but its calendar-writing command pattern needs review because untrusted itinerary text could be passed into a shell command without stated safety controls.

Review before installing. Use this only if you trust the itinerary sources and are comfortable granting gog access to create Google Calendar events. Confirm event titles, locations, descriptions, dates, and especially time zones before approving. A safer version should narrow activation to travel requests and require direct argument execution or explicit escaping instead of interpolating parsed text into a shell command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15

Finding

Potential Shell Command Injection Through Unescaped Calendar Fields

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–32
Vulnerability Type: Command injection through unsafe command construction
Risk Level: Medium

markdown

When user confirms "add to calendar":
1. Create events for key milestones using gog:
   - ✈️ Flights (with terminal, timing)
   - 🏨 Hotel check-in / check-out (with address)
   - 🥾 Major activities (treks, tours)
   - 🚕 Major transport

2. Command format:
   gog calendar create primary --summary "✈️ DEL→KLU 6E-2041" --from "2026-03-14T06:00:00+05:30" --to "2026-03-14T07:30:00+05:30" --location "DEL Terminal 1" --description "Reach airport by 4:30 AM"

3. Use emojis in titles: ✈️ flights, 🏨 hotels, 🥾 treks, 🚕 transport
4. Include location and useful details in description

## Boarding pass parsing
When user sends boarding pass image:
1. Extract: flight number, date, time, origin, destination, gate/terminal
2. Confirm with user
3. On confirmation, create calendar event

Technical Analysis

The skill directs the agent to extract calendar fields from user messages or boarding-pass images and place them into a command-line template. Fields such as the summary, location, and description are therefore untrusted input.

The instructions do not require validation, escaping, or execution through a structured argument-array API. If an implementation interpolates these values into a command string and passes that string to a shell, embedded quotation marks, command substitutions, separators, or other shell metacharacters could terminate the intended argument and introduce additional shell operations.

Explicit confirmation prevents calendar modifications without user approval, but it does not neutralize malicious syntax contained in the confirmed event data. Exploitability depends on the agent's command-execution mechanism: direct process execution with separate arguments would substantially mitigate the issue, while shell-based str ...[truncated 1304 chars]

Remediation

View remediation

Remediation Suggestions

1. Invoke gog directly through a process API using a structured argument array. Do not construct a shell command by concatenating itinerary fields.
2. Explicitly state in the skill instructions that calendar values must never be passed through sh -c, bash -c, or an equivalent shell interpreter.
3. Validate structured fields using strict allowlists:
   • Parse dates and times with a recognized date-time parser.
   • Restrict flight numbers to the expected airline and numeric format.
   • Validate airport codes against an expected format or known set.
   • Reject null bytes and control characters from all text fields.
4. Preserve summaries, locations, and descriptions as literal process arguments. If shell execution is unavoidable, use platform-appropriate escaping supplied by a well-tested library rather than custom quoting.
5. Display normalized event values during confirmation so the user approves exactly what will be sent to the calendar API.
6. Run calendar automation with the minimum required permissions and avoid exposing unrelated credentials or sensitive environment variables to the command process.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation phrases include very broad language such as "add to calendar" and "put this on my calendar," which can match many non-travel contexts and cause the skill to activate outside its intended scope. In a skill that can create Google Calendar events via CLI, overbroad triggering increases the risk of unintended actions, confusion, or calendar modifications based on unrelated user requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The rule to "Always use IST timezone (+05:30)" can silently create incorrect event times for users traveling across regions or for itineraries outside India. In a calendar-writing skill, forced timezone handling can cause missed flights, hotel check-in errors, or transport disruptions because the recorded times may not reflect the actual local timezone of each itinerary segment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.