Security audit

日历管理工具包专业版

Security checks across malware telemetry and agentic risk

Overview

This calendar skill is Markdown-only, but it asks for broad command and file authority and describes bulk calendar changes, exports, webhooks, and credential checks without tight user-control boundaries.

Review this before installing in any real calendar or team environment. It may perform broad automated scheduling, export data, call APIs or webhooks, inspect local configuration variables, and run shell commands. Use only with explicit per-action approval, limited calendar/API credentials, and disabled or tightly scoped exec access.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill is presented as a calendar toolkit, but later claims broad file processing, API integration, command execution, and information retrieval capabilities. This scope expansion is dangerous because it can cause an agent to apply the skill in unrelated contexts and invoke powerful tooling such as exec without a narrowly defined business need or permission boundary.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The configuration validation step tells the agent to enumerate environment variables matching API, KEY, TOKEN, SECRET, and PROFILE. Even though values are masked in output, this still probes for sensitive material, reveals what secrets exist, and normalizes secret discovery behavior that is unnecessary for ordinary calendar operations.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill claims that only whitelisted commands should be executed, but no whitelist, allowlist policy, or enforcement mechanism is actually provided while the skill has access to exec. This mismatch is dangerous because it creates a false sense of safety and leaves the agent free to run arbitrary shell commands under a broad automation framing.

Vague Triggers

High

Confidence: 92% confidence
Finding: The description says the skill should be used whenever AI model calling, agent orchestration, or LLM applications are needed, which is far broader than calendar scheduling. Overly broad invocation language increases the chance that an agent will select this skill for unrelated tasks, thereby exposing read/exec/grep/glob capabilities outside intended scope.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The natural-language trigger examples are broad and do not specify limits, confirmation requirements, or exclusions before performing actions. In an autonomous agent setting, vague triggers can cause unintended calendar modifications or premature action selection without sufficient user intent verification.

Missing User Warnings

High

Confidence: 93% confidence
Finding: The skill advertises create/query/export operations and enterprise batch features without a clear upfront warning that it can automatically modify or export calendar data. This is dangerous because users and agents may underestimate the scope of side effects, especially in multi-tenant or team contexts where actions can affect many users at once.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill documents API integration and webhook event notifications without clearly warning that calendar content, metadata, or operational logs may be transmitted to third-party services. In a business calendar context, this can expose sensitive meeting details, participant data, resource bookings, or internal activity patterns.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The batch and concurrency examples normalize large-scale execution but do not clearly warn that operations may apply changes across multiple targets quickly and simultaneously. In enterprise calendar workflows, this can amplify mistakes, causing mass event creation, modification, export, or notification storms before operators notice.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.