Trip Calendar
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears benign: it adds travel items to Google Calendar after confirmation, but it will use your Google Calendar access and the gog command.
This skill is reasonable for adding travel plans to Google Calendar. Before installing or using it, make sure the gog CLI is trusted and connected to the correct Google account, and review the events before giving confirmation.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent can add events to your Google Calendar when you confirm.
The skill instructs the agent to use a local CLI tool to create events in the user's primary calendar. This is purpose-aligned and requires confirmation, but it is still a real account-mutating action.
gog calendar create primary --summary "✈️ DEL→KLU 6E-2041"
Before confirming, review the event details and make sure the gog CLI is connected to the correct calendar account.
The skill relies on whatever Google Calendar permissions the gog CLI already has.
Creating Google Calendar events requires delegated access to the user's Google account through gog. This is expected for the stated purpose, and the artifact does not show token logging, unrelated access, or hidden credential handling.
Add trip itineraries, flights, hotel check-ins, and activities to Google Calendar using gog CLI.
Confirm that gog is authorized only as broadly as you are comfortable with and that it points to the intended Google account.
A compromised or unexpected gog binary could affect what happens when the skill creates calendar events.
The skill does not install code itself, but its behavior depends on an external preinstalled gog binary whose provenance is not described in the artifacts.
Required binaries: gog; No install spec — this is an instruction-only skill.
Use a trusted installation of gog and verify it before relying on this skill.