Calendar Reminder Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.0

Overview

This calendar reminder skill has a coherent purpose, but it asks users to create a recurring agent cron job that runs an unbundled local script with calendar and messaging access.

Review before installing. Only use this if you are comfortable creating a recurring agent task that reads your Outlook calendar and sends event details to Feishu. Confirm the exact calendar_reminder.py implementation yourself, restrict credentials, set the correct timezone and Feishu recipient, and know how to remove the cron task before enabling it.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:131

Finding

Persistent Scheduled Execution Through Agent Cron

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 131–137
Vulnerability Type: Persistent scheduled task
Risk Level: High

Complete Code Snippet

bash

skill-platform cron add \
  --name "calendar-daily-scan" \
  --cron "0 22 * * *" \
  --tz "Asia/Shanghai" \
  --session main \
  --system-event "CALENDAR_SCAN: 请立即运行 python3 ~/.skill-platform/workspace/skills/calendar-reminder/calendar_reminder.py 并等待完成" \
  --description "每晚22:00扫描明天日历并设置提醒"

Technical Analysis

The Skill instructs the user or Agent to register a daily scheduled event that persists beyond the initial Skill run. At 22:00 each day, the event is delivered to the main Agent session and directs it to execute:

bash

python3 ~/.skill-platform/workspace/skills/calendar-reminder/calendar_reminder.py

This creates a persistent execution mechanism tied to a Python file in a user-writable workspace. The referenced calendar_reminder.py file is not included in the audited project, so its behavior, integrity, credential handling, and outbound communications cannot be reviewed. If that path is populated or modified after the schedule is registered, the new content may receive recurring execution without another review of this Skill.

Attack Path

1. A user or Agent follows the setup instructions in SKILL.md.
2. skill-platform cron add registers the daily task for the main Agent session.
3. The scheduled task persists after the setup operation completes.
4. An attacker, compromised dependency, or another process with write access places or replaces calendar_reminder.py at the referenced workspace path.
5. At the next scheduled invocation, the system event instructs the Agent to execute the unreviewed Python file.
6. The substituted script runs with the permissions and accessible credentials of the invoking Agent or user.
7. The task continues to trigger daily until explicitly removed.

Impact Assessmen

...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not register recurring tasks automatically; require explicit, informed user approval that identifies the schedule, target command, execution identity, and removal procedure.
2. Include the referenced implementation in the Skill package so it can be audited before use.
3. Execute only an immutable or integrity-verified artifact. Pin an expected cryptographic hash and refuse execution if verification fails.
4. Store the script in an administrator-controlled, non-user-writable location with restrictive ownership and permissions.
5. Avoid delivering executable instructions to the main Agent session. Use a narrowly scoped scheduler identity with only the calendar-read and notification permissions required.
6. Apply an expiration date or bounded invocation count to the task and provide a clear command to disable and remove it.
7. Validate the task target immediately before every run and reject symbolic links, unexpected ownership, writable parent directories, or changed content.
8. Keep credentials out of the script and expose only narrowly scoped secrets at runtime.
9. Log task creation, modification, execution, integrity failures, and removal, and alert the user when the executable target changes.
10. Document and verify cleanup with:

    bash

    skill-platform cron remove --name "calendar-daily-scan"
    

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are both unrelated to the stated function and overly broad, which is especially risky because the skill allows exec and interacts with external systems. Ambiguous invocation criteria increase the chance that an agent will select this skill in inappropriate contexts, potentially exposing calendar contents or sending outbound messages when the user did not intend to use a reminder tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The overview describes automation benefits but does not clearly warn users that the skill reads calendar data and transmits schedule details through Feishu, which may include sensitive meeting titles, times, and locations. This omission weakens informed consent and can lead to unintentional disclosure of personal or business-sensitive scheduling information.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill states that it processes time based on the Asia/Shanghai timezone, which is a locale-specific default. Although later sections mention it can be modified, this core behavior is presented as fixed rather than explicitly opt-in or user-selectable at activation time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a calendar reminder tool, but the documentation advertises generic create/query/modify/delete/export capabilities through abstract parameters like input_params, config_options, and output_format. In an agent setting, this kind of capability overstatement can cause the model or operator to authorize actions beyond the intended scope, increasing the risk of unsafe tool use or unintended data handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger-condition section says the skill should be used for data analysis, report generation, statistical insight, and visualization, which directly contradicts its stated calendar-reminder purpose. In an agent workflow, contradictory routing guidance can cause the skill to be invoked for unrelated tasks, leading to misuse of exec-enabled behavior and unexpected access to calendar or messaging functions.

Content

No source excerpt is available for this finding.