ClawHub
Back to skill

Security audit

Calendar Reminder Paid

Security checks across malware telemetry and agentic risk

Overview

This calendar reminder skill is purpose-aligned, but it can automatically share sensitive personal and work calendar details with admins or messaging channels without enough scoping guidance.

Review exactly which calendars are connected, who receives Feishu or Telegram notifications, and where CSV reports are stored before installing. Avoid connecting personal or sensitive team calendars unless recipients and retention are tightly controlled, and only enable the cron job if automatic recurring scans and reports are intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes aggregating multiple calendars and sending schedule contents to Feishu without a clear upfront privacy warning, consent requirement, or guidance on limiting recipients. Because calendar data can contain sensitive meeting titles, locations, and personal appointments, users may unintentionally disclose private or corporate information to admins or shared channels.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The weekly analysis flow exports detailed calendar records to CSV and transmits analytics summaries through messaging channels without an explicit data-handling warning or retention guidance. This creates a realistic risk of sensitive business schedule data being stored insecurely, forwarded, or exposed to unintended recipients.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.