Calendar Hold Sync

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent calendar-sync tool, but it copies source event details into target calendar event descriptions and can create, update, or delete managed holds, so users should review its privacy impact before use.

Install only after deciding that copying source event titles and identifiers into target calendar descriptions is acceptable for your sharing model. Test with dryRun enabled, use dedicated target calendars where possible, keep maxChangesPerRun conservative, and leave custom gog command overrides disabled unless you fully audit the config.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46
• Finding: Reversible Metadata Exposes Source Calendar Details in Target Events## Vulnerability Details **File Location**: `SKILL.md:46-48, 71-82` **Additional Locations**: `SKILL.base.md:41-43, 66-77`; `config/sample.config.json:24-28` **Vulnerability Type**: Sensitive information stored using reversible encoding **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown - `metadata.format` (`SYNCV1`) - `metadata.encoding` (`base64url(json)`) - `metadata.fields`: `srcAccount,srcCalendar,eventId,start,end,title` ## Metadata Encoding Store source linkage in hold `description` as: - `SYNCV1:<base64url(JSON)>` JSON fields: - `srcAccount` - `srcCalendar` - `eventId` - `start` - `end` - `title` ``` The corresponding sample configuration is: ```json "metadata": { "format": "SYNCV1", "encoding": "base64url(json)", "fields": ["srcAccount", "srcCalendar", "eventId", "start", "end", "title"] } ``` ### Technical Analysis The skill instructs implementations to copy source calendar metadata into each target hold's description. The stored data includes the source account, source calendar identifier, source event identifier, event times, and event title. Base64url is an encoding mechanism, not encryption. Any party or integration with permission to read the target event description can decode the value without possessing a secret key. Consequently, marking the target event as private and giving it the generic summary `Busy` does not prevent disclosure through its description. This creates a confidentiality boundary violation when source and target calendars have different readers, integrations, administrators, retention policies, or account ownership. The target calendar receives substantially more source information than is necessary to represent an unavailable time interval. ### Attack Path 1. An attacker, delegated calendar user, administrator, or third-party integration obtains legitimate or compromised read access to the target calendar. 2. The party rea ...[truncated 1434 chars]
• Remediation: ## Remediation Suggestions 1. Remove `title`, `srcAccount`, and `srcCalendar` from metadata stored in target event descriptions. 2. Replace raw source identifiers with a deterministic opaque identifier, such as an HMAC computed from the source account, calendar ID, and event ID using a locally managed secret. 3. Store only the minimum metadata required for idempotent reconciliation. Prefer an opaque linkage token and avoid duplicating event times if the target event already contains them. 4. If reversible metadata is operationally required, use authenticated encryption rather than base64url encoding. Keep the encryption key outside calendar data and configuration files, using an operating-system credential store or dedicated secret manager. 5. Ensure encrypted payloads use unique nonces and integrity protection, such as AES-GCM or ChaCha20-Poly1305. 6. Document explicitly that target event descriptions may be visible to calendar delegates, administrators, API clients, and connected integrations. 7. Add tests confirming that generated target holds do not contain plaintext or trivially decodable source titles, account addresses, calendar IDs, or event IDs. 8. Provide a migration routine that updates existing holds and removes legacy `SYNCV1` descriptions containing sensitive metadata.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

If `gog` is not configured, use this setup flow:

1. Run `gog auth credentials /path/to/client_secret.json`.
2. Run `gog auth add [e-mail] --services calendar`.
3. Verify with `gog auth list`.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The metadata format explicitly includes source event title and other source details encoded into the target hold description, but the skill does not prominently warn about this privacy consequence. Even if base64url-encoded, the data is only encoded rather than protected, so sensitive meeting names or other source metadata may be exposed to anyone with access to the target calendar event details.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill describes reconcile/backfill behavior functionally, but it does not clearly warn users up front that running these operations will create, update, and delete events in target calendars. In a calendar-automation skill, omission of destructive side effects is security-relevant because users may authorize or run it without understanding it can modify production calendars at scale.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs operators to copy source linkage metadata into target event descriptions, including the source event title. In a calendar-sync context, that can expose sensitive meeting names and scheduling details into secondary calendars, delegated views, exports, or downstream tooling, creating a real confidentiality risk even though the hold event is marked private.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This markdown file describes reconcile behavior that includes deleting stale holds, which is a data-affecting operation on users' calendars. Although the behavior is specified, there is no clear warning or caution statement highlighting that running the skill may remove calendar events it previously manages.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The metadata design copies source event attributes such as title, account/calendar linkage, event ID, and timestamps into the target hold description. Even though the holds are marked private, this still replicates potentially sensitive information into another calendar object and account context, which can expand exposure through calendar sharing, exports, backups, admin access, or client displays.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that reconcile will create, update, and delete hold events, but it does not prominently warn users up front that running the sync can modify or remove events in target calendars. In an automation skill that operates on real calendars, incomplete disclosure increases the risk of unintended data loss or disruptive calendar changes, especially if users misconfigure mappings or run against the wrong target calendar.

Static analysis

No suspicious patterns detected.