ClawHub
Back to skill

Security audit

calendar-toolkit-free

Security checks across malware telemetry and agentic risk

Overview

This calendar skill is broadly purpose-aligned, but it gives agents live calendar and sync authority while making unclear and contradictory claims about privacy and data flow.

Review this skill carefully before installing. It may create or change calendar events and sync calendar data with external services, despite also claiming local-only storage. Use it only with accounts you are comfortable connecting, avoid broad API keys, and require explicit confirmation before any event creation, deletion, export, callback notification, or cross-provider sync.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

High
Confidence
93% confidence
Finding
The document claims FREE-version data is stored locally and never uploaded to the cloud, yet elsewhere it explicitly references external APIs, cross-provider sync, and callback URLs. This can mislead users into providing sensitive calendar content under false privacy assumptions, causing unintended disclosure to third-party services.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are overly broad and mismatched, telling agents to invoke a calendar skill for data analysis, reporting, statistics, and visualization. In an agentic context, vague routing increases the chance the skill is activated for unintended tasks, which may lead to unnecessary data access, modification, or disclosure across calendar providers.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill describes operational capabilities like creating events, arranging meetings, and cross-platform sync without a prominent warning that these actions can modify live calendar data and transmit it to external providers. Users may interpret the skill as informational rather than state-changing, increasing the risk of accidental calendar edits or third-party data sharing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.