Security audit

日历

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a calendar helper, but its instructions are inconsistent and too broad for a tool that can create or delete Google Calendar events.

Review this skill carefully before installing. It may be useful for Google Calendar automation, but it needs clearer setup instructions, narrower activation criteria, accurate output documentation, and explicit user confirmation before deleting or changing calendar events.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documented return schema describes a grading/report payload unrelated to calendar operations, which indicates the skill documentation may be templated, misleading, or mismatched with the actual behavior. In an agent setting, inconsistent I/O contracts can cause downstream automation to mis-handle outputs, trust incorrect fields, or route data into the wrong workflows, creating opportunities for logic abuse or unsafe follow-on actions.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims to manage Google Calendar via gcalcli, but the dependency section lists only a generic LLM API and a placeholder API_KEY flow, omitting the actual calendar CLI/tooling and authentication requirements. This mismatch can lead operators or agents to execute the skill in an improperly configured environment, improvise missing commands or credentials, or connect the wrong secrets, increasing the risk of command misuse, credential exposure, and unsafe fallback behavior.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The invocation guidance uses broad scenario-based language such as using the skill whenever project management, planning, tracking, or collaboration is needed, without defining narrow trigger boundaries. In an autonomous or semi-autonomous agent, this can cause over-invocation of a skill with exec/write capabilities in contexts that do not actually require calendar access, expanding the chance of unintended actions on user calendars or unnecessary command execution.

Natural-Language Policy Violations

Medium

Confidence: 74% confidence
Finding: The description states that the skill supports Chinese interaction by default without making language selection explicit. While not a direct exploit primitive, defaulting interaction language without user opt-in can cause misunderstanding of prompts, confirmations, or destructive calendar actions, especially in multilingual environments where precision matters.

Static analysis

No suspicious patterns detected.