日历技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 1.0.3

Overview

This calendar skill is not clearly malicious, but it asks for broad file and command powers and contains mismatched, under-scoped documentation.

Install only if you are comfortable reviewing and constraining its permissions first. It should not receive generic command execution or broad file read/write access for normal calendar use, and calendar credentials should be provided only through least-privilege provider authorization rather than pasted into conversation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:20

Finding

Excessive Tool Permissions for a Calendar Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–23
Vulnerability Type: Violation of least privilege through unnecessary file-system and command-execution capabilities
Risk Level: Medium

Vulnerable Code Snippet:

yaml

tools:
- read
- exec
- write

Technical Analysis

The skill declares general-purpose file-reading, file-writing, and command-execution tools even though its documented purpose is calendar management. The artifact contains no implementation demonstrating that these capabilities are required, no path restrictions for file operations, no command allowlist, and no enforceable sandbox policy.

Calendar operations should normally be performed through narrowly scoped provider APIs and least-privilege OAuth permissions. Granting generic read, write, and especially exec capabilities expands the skill's authority beyond its stated function.

Exploitability depends on the host agent treating these declarations as authorization and making the tools available when the skill is loaded. If the host independently restricts or ignores them, the practical risk is reduced. The declaration alone does not prove that commands are automatically executed.

Attack Path

1. A user or agent loads the calendar skill.
2. The host platform grants the declared read, write, and exec capabilities.
3. Untrusted calendar content, user-controlled event text, or later instructions influence the agent's tool selection.
4. The agent uses the broadly scoped tools instead of a restricted calendar API.
5. Depending on host controls, the agent may read unrelated local files, modify accessible files, or execute arbitrary operating-system commands under the agent process's identity.

Impact Assessment

If the declared permissions are honored without additional controls, the skill could obtain all file-system and command-execution privileges available to the hosting agent process. Potential e ...[truncated 446 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec, read, and write from the skill declaration unless each capability is strictly necessary and supported by an implemented workflow.
2. Replace general-purpose tools with provider-specific Google Calendar, Microsoft Outlook, or Exchange API integrations.
3. Use least-privilege OAuth scopes and request separate authorization for read-only and event-modification operations.
4. If local file access is required, restrict it to explicit application-owned paths and reject traversal, symbolic-link escapes, and arbitrary absolute paths.
5. If command execution is unavoidable, use a fixed executable and argument allowlist, prohibit shell interpretation, run in an isolated sandbox, and require explicit user confirmation.
6. Require confirmation before creating, modifying, sharing, or deleting calendar events.
7. Treat event titles, descriptions, attachments, and attendee-controlled content as untrusted data and prevent them from being interpreted as tool instructions.
8. Document the precise purpose and security boundary of every requested tool permission.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation guidance is overly broad, mixing calendar use with project management, task planning, progress tracking, and team collaboration without clear boundaries. Ambiguous scoping increases the chance that an agent will invoke the skill for tasks outside its intended function, potentially exposing unnecessary data or triggering unsafe tool use under false assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states '支持中文交互，无需复杂配置即开即用', which presents Chinese interaction as a default capability without clarifying that other languages are supported or that the user can choose the language. This can violate language/locale policy when a skill appears to impose a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill handles calendar providers and likely requires credentials or tokens, yet it lacks a clear warning that calendar data and authentication material may be transmitted to external services. Because calendars often contain sensitive business and personal metadata, missing disclosure and handling guidance can lead users or agents to expose confidential schedules, attendee lists, and access tokens without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented JSON response schema describes grading, scoring, and audit-style outputs rather than calendar operations such as event creation, listing, updates, or sync status. This mismatch can cause an agent or user to route unrelated sensitive inputs into the skill or mis-handle outputs, increasing the risk of unsafe automation decisions and data disclosure through confused-deputy behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The paid-feature FAQ advertises vulnerability, compliance, risk scoring, and threat-intelligence capabilities that are unrelated to a calendar skill. This broadens the apparent authority of the skill and may mislead agents into sending security-review tasks, credentials, or internal asset data to a skill not scoped for that purpose, creating confusion and possible exposure of sensitive information.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.