日历管理技能基础版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:38 AM UTC
• Version: 1.0.4

Overview

This calendar skill has useful, disclosed calendar functions, but its documentation overstates unrelated capabilities and understates cloud/API data sharing and local authority risks.

Review this carefully before installing. Use a least-privilege calendar account, confirm every create/update/delete action, avoid running the broad environment-variable check, and verify the porteden CLI source/version before authentication. Calendar data may be sent to external calendar providers or the porteden integration despite the artifact's local-only claim.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:151

Finding

Unpinned Executable Dependency Installed from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 151-155
Vulnerability Type: Supply-chain exposure through an unpinned executable dependency
Risk Level: High

Vulnerable Code

bash

brew install porteden/tap/porteden
# Login
porteden auth login
# Or use an API key
export PE_API_KEY="${API_KEY:?API key environment variable must be set}"

The same unpinned installation command is repeated at line 193.

Technical Analysis

The Skill instructs users or agents to install the porteden executable from the third-party Homebrew tap porteden/tap without specifying a reviewed version, immutable commit, cryptographic checksum, or signature-verification process.

The installed executable is subsequently used for authentication and calendar operations. It may therefore receive an API key, OAuth authorization, calendar data, and permission to create, update, or delete events. Because the dependency is mutable, the code executed during a future installation can differ from the code that existed when the Skill was audited.

This does not establish that the current package is malicious. It creates a supply-chain weakness under which compromise of the tap, formula, release infrastructure, or publisher account could introduce attacker-controlled executable code.

Attack Path

1. An attacker compromises the Homebrew tap, its publisher account, or an artifact referenced by its formula.
2. The attacker publishes a modified release while retaining the expected package and command names.
3. A user or agent follows the Skill instruction and runs brew install porteden/tap/porteden.
4. Homebrew installs the modified executable because no immutable version, checksum-validation procedure, or trusted signature requirement is specified by the Skill.
5. The user runs porteden auth login or exposes PE_API_KEY in the process environment.
6. The compromised executable accesses the granted calendar author ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed, immutable version or commit rather than installing the latest mutable release.
• Document the canonical source repository and expected publisher identity.
• Publish and verify cryptographic checksums or signed release artifacts before installation.
• Prefer a trusted package source with transparent provenance, reproducible builds, and protected release workflows.
• Avoid making package installation an automatic Agent action; require explicit user approval before installing executable software.
• Request only the minimum calendar OAuth scopes required for the requested operation.
• Run the CLI in a sandbox with restricted filesystem and environment access.
• Document a dependency update process that requires security review before changing the pinned version.

other

Note

• Location: SKILL.md:165

Finding

Broad Enumeration of Credential-Related Environment Variables

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 165-169
Vulnerability Type: Unnecessary environment reconnaissance
Risk Level: Low

Vulnerable Code

bash

# Verify whether environment variables are set
echo "Configuration check:"
env | grep -E "API|KEY|TOKEN|SECRET" | sed "s/=.*/=***/"  # Linux/macOS

Technical Analysis

The configuration check enumerates the complete process environment and selects every variable whose name contains API, KEY, TOKEN, or SECRET. Although sed masks values in the displayed output, the command exposes the names of unrelated credentials and integrations to the Agent, terminal transcript, logs, or other output consumers.

The calendar Skill only needs to determine whether its own expected variable, PE_API_KEY, is configured. Enumerating unrelated credential-variable names exceeds that requirement and discloses potentially sensitive information about available services and authentication material.

Masking occurs after env emits the variables into a pipeline. While this shell pipeline normally sends the unmasked output directly to grep and then sed, debugging, tracing, wrappers, or telemetry around command execution could increase exposure. The confirmed issue is the unnecessary enumeration and disclosure of credential-related variable names; direct disclosure of their values is not demonstrated by the audited command.

Attack Path

1. An agent executes the recommended configuration-validation command.
2. The command scans all environment variables instead of checking only PE_API_KEY.
3. Names of unrelated credential variables are included in the command output after their values are masked.
4. The output is retained in the Agent context, terminal history, execution logs, or an external transcript.
5. An attacker with access to that output learns which credentials or connected services are likely present and can use that information to gui ...[truncated 505 chars]

Remediation

View remediation

Remediation Suggestions

Replace broad environment enumeration with a targeted boolean check that does not print the secret:

bash

if [ -n "${PE_API_KEY:-}" ]; then
  printf '%s\n' "PE_API_KEY is configured"
else
  printf '%s\n' "PE_API_KEY is not configured"
fi

Alternatively, use printenv PE_API_KEY >/dev/null and report only its success or failure.

Additional hardening should include:

• Never run env solely to validate one configuration variable.
• Prevent shell tracing while commands interact with credentials.
• Ensure Agent execution logs redact both secret values and unnecessary environment metadata.
• Keep credential checks scoped to documented variables owned by this Skill.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Inconsistent and Overbroad Agent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-21
Vulnerability Type: Excessive and conflicting tool authorization
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec
compatibility: "Requires LLM with tool-use capability"
metadata:
  displayName: "Calendar Management Skill Basic Edition"
  version: "1.0.0"
  summary: "Safely manage Google and Outlook calendars through the porteden CLI"
  tags:
    - "Calendar"
    - "porteden"
    - "Outlook"
    - "Google Calendar"
  source: "SkillHub"
  converted_at: "2026-07-22T17:58:36"
tools:
  - exec
  - read
  - write

Technical Analysis

The front matter contains two conflicting tool declarations. allowed-tools authorizes read and exec, while the separate tools list additionally declares write. Agent platforms may interpret one declaration, merge both declarations, or select the broader list. This ambiguity can result in filesystem-write permission being granted even though the documented calendar workflow does not establish a need to modify local files.

The Skill also grants general filesystem-read permission without defining required paths. Its primary documented operations are performed through the porteden CLI, so unrestricted read and write access are broader than the stated calendar-management purpose.

Excessive tool permissions increase the consequences of prompt injection from untrusted event content, malformed user input, implementation mistakes, or compromise of an invoked dependency. The document advises treating event content as untrusted, but no enforceable path restrictions or tool policy accompany that guidance.

Attack Path

1. An Agent host loads the Skill and processes both permission declarations.
2. The host selects or merges the broader tools list and grants exec, read, and write.
3. The Skill processes attacker-controlled calendar content or another untrusted ...[truncated 1192 chars]

Remediation

View remediation

Remediation Suggestions

• Use one authoritative tool-permission declaration and remove the conflicting duplicate.
• Remove write unless a documented calendar workflow strictly requires local file creation.
• Remove read if all required operations can be completed through a narrowly controlled calendar API or CLI tool.
• If filesystem access is necessary, restrict it to explicitly documented files and directories.
• Replace unrestricted exec with an allowlisted calendar tool interface where supported.
• Require explicit user confirmation for authentication and all create, update, and delete operations.
• Enforce the instruction that calendar event content is untrusted at the tool-policy level, not only in documentation.
• Isolate the CLI in a sandbox with minimal environment, filesystem, and network access.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest description advertises security detection, compliance auditing, vulnerability scanning, and encryption protection, but the body of the skill only documents calendar CRUD operations through the porteden CLI. This mismatch can cause an agent or user to invoke the skill in inappropriate security-sensitive contexts, creating misplaced trust and potentially leading to unauthorized or destructive calendar actions under the false assumption that a security tool is being used.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger text says to use the skill for data analysis, report generation, statistical insights, and visualization, which is far broader than the documented calendar-management functionality. In an agent setting, overly broad triggers increase the chance of accidental invocation in unrelated workflows, causing the agent to run calendar commands with sensitive account access when the user intended a different tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill states that all data is stored locally and not uploaded to the cloud, yet elsewhere it explicitly requires network access and external APIs for Google/Outlook calendar operations. This is a dangerous privacy and security misrepresentation because users may expose calendar data, attendees, and metadata to third-party services while believing no remote transmission occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill exposes update and delete event capabilities but does not place an explicit destructive-action warning or mandatory confirmation near that capability description. In an agent-executed skill with exec access, this raises the risk of unintended event modification or deletion, especially if natural-language requests are ambiguous or routed automatically.

Content

No source excerpt is available for this finding.