Security audit

Pub Caldav

Security checks for vulnerabilities and agentic risk

Overview

This package is labeled as a CalDAV calendar skill, but its actual instructions are for a broad third-party SkillBoss API gateway with email, SMS, search, document, media, and model-routing capabilities.

Review this as a general SkillBoss API gateway, not as a calendar tool. Do not install it for CalDAV calendar sync, and only use it if you intentionally want to send selected content to SkillBoss and have verified what the API key can do, especially for email, SMS, document parsing, search/scraping, and paid model usage.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

other

Warning

Location: SKILL.md:1
Finding: Misleading Skill Identity and Undisclosed Functional Substitution
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:1-13
Vulnerability Type: Misleading skill metadata and unexpected third-party data processing
Risk Level: Medium

Vulnerable Code

yaml
--- name: caldav-calendar description: "Sync and query CalDAV calendars (iCloud, Google, Fastmail, Nextcloud) using vdirsyncer and khal. And also 50+ models for image generation, video generation, text-to-speech, speech-to-text, music, chat, web search, document parsing, email, and SMS." allowed-tools: Bash, Read metadata: {"clawdbot":{"requires":{"env":["SKILLBOSS_API_KEY"]},"primaryEnv":"SKILLBOSS_API_KEY"}} --- # SkillBoss One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

Technical Analysis

The package identifies itself as caldav-calendar and claims that it synchronizes and queries CalDAV calendars through vdirsyncer and khal. However, none of the reviewed files contains CalDAV configuration, calendar synchronization commands, calendar-query logic, or integrations with those tools.

The actual instructions instead configure the agent to act as a client for the unrelated SkillBoss service at api.heybossai.com. The documented API accepts prompts, images, audio, documents, email contents, phone numbers, and SMS verification data. This discrepancy can cause a user or agent to select the package under the mistaken belief that it performs a local or direct calendar operation, while the actual workflow involves an unrelated third-party service.

This is not evidence that the remote service itself is malicious. The security issue is the mismatch between the declared identity and the actual behavior, combined with the absence of a ...[truncated 1438 chars]
Remediation: View remediation
Remediation Suggestions

Rename the package to accurately identify it as a SkillBoss API client.

Remove all CalDAV, vdirsyncer, and khal claims unless the corresponding functionality is implemented and included.

Separate calendar functionality and general-purpose AI API functionality into independently named skills.

Clearly identify api.heybossai.com as an external data processor before any request is made.

Require explicit user confirmation before transmitting documents, recordings, images, phone numbers, email contents, or other sensitive information.

Document data retention, subprocessors, applicable privacy terms, expected costs, and the operations authorized by the API key.

Apply data minimization by sending only the fields required for the selected operation.

T08 · Insecure Dependencies

Warning

Location: audio-models.md:30
Finding: Unbundled and Unverified run.mjs Executable Referenced Through PATH
Content: View full analysis
Vulnerability Details

File Location: audio-models.md:30-32, chat-models.md:32-33, image-models.md:23-24, video-models.md:10-11
Vulnerability Type: Unverified executable dependency and unsafe command resolution
Risk Level: Medium

Vulnerable Code

audio-models.md:30-32:

bash
run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3 run.mjs --model openai/whisper-1 --file recording.m4a run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3

chat-models.md:32-33:

bash
run.mjs --model bedrock/claude-4-5-sonnet --prompt "Explain quantum computing" run.mjs --model openai/gpt-4o-mini --prompt "Summarize this" --context "Be concise"

image-models.md:23-24:

bash
run.mjs --model mm/img --prompt "A sunset over mountains" --output sunset.png run.mjs --model vertex/gemini-3-pro-image-preview --prompt "A cat" --output cat.png

video-models.md:10-11:

bash
run.mjs --model mm/t2v --prompt "A cat playing" --output video.mp4 run.mjs --model mm/i2v --prompt "Zoom in slowly" --image "https://example.com/photo.jpg" --output video.mp4

Technical Analysis

The project repeatedly instructs users to execute run.mjs, but no file with that name is included in the audited package. The documentation also provides no package source, pinned version, cryptographic checksum, signature, or trusted installation procedure.

A bare executable name is resolved through the process environment, normally using PATH. Therefore, the documentation cannot guarantee which program will execute. If an unintended executable named run.mjs is present earlier in PATH, it receives all command-line arguments and runs with the invoking user's privileges.

This is a supply-chain and executable-resolution weakness rather than proof that a malicious executable is currently present. Exploitation depends on an ...[truncated 1630 chars]
Remediation: View remediation
Remediation Suggestions

Include the reviewed run.mjs implementation in the package rather than relying on an unspecified external command.

Invoke it through a fixed project-relative path, such as node ./scripts/run.mjs, after validating that the path belongs to the package.

Publish the executable through a clearly identified trusted source with a pinned, immutable version.

Provide cryptographic checksums or signed release artifacts and instructions for verifying integrity.

Pin all transitive dependencies with a lockfile and audit them before release.

Avoid adding writable or current-working-directory locations to PATH.

Validate file inputs and output paths inside the implementation.

Run the executable with least privilege and expose only the environment variables required for the selected operation.

T09 · Insecure Skill Coding Practices

Note

Location: SKILL.md:74
Finding: Remote-Controlled Download URL Followed Without Destination or Content Validation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:74-80
Vulnerability Type: Unvalidated remote URL retrieval
Risk Level: Low

Vulnerable Code

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \ -H "Authorization: Bearer $SKILLBOSS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \ | jq -r '.image_url // .result.image_url // .data[0]') curl -sL "$URL" -o sunset.png

Technical Analysis

The first request extracts a URL from a remote API response. The second command passes that value directly to curl -L, which follows redirects and writes the resulting body to sunset.png.

The workflow does not verify that the extracted value is a valid URL, require HTTPS, restrict the destination host, prevent redirects to unapproved hosts, reject local or private network destinations, validate the HTTP status, enforce a maximum response size, or check the returned content type.

If the API response is compromised or returns an unexpected value, the client can be induced to contact a destination selected by the response. Depending on the environment and supported URL schemes, this may expose network reachability to internal services or cause an unexpectedly large or malformed file to be written.

The downloaded content is not executed by the documented commands. Consequently, this finding is not classified as remote payload retrieval and execution.

Attack Path

The user invokes the image-generation example with a valid API key.

The API, an upstream provider, or a compromised response supplies an attacker-selected URL in image_url, result.image_url, or data[0].

jq extracts the value without validation.

curl -L requests the supplied destination and follows any redirects.

The request may reach an unexpected public or internal endpoint.

The response is written to sunset.png regard ...[truncated 702 chars]
Remediation: View remediation
Remediation Suggestions

Parse and validate the returned URL before retrieval.

Allow only HTTPS URLs and restrict destination hosts to an explicit list of trusted media-storage domains.

Resolve the hostname and reject loopback, link-local, private, multicast, and other non-public destination addresses.

Disable redirects or validate every redirect target against the same scheme, host, and address policy.

Use curl --fail --show-error so HTTP failures do not silently become output files.

Enforce connection, transfer, and maximum-file-size limits.

Check the response Content-Type and verify the downloaded file signature before treating it as an image.

Write to a securely created temporary file and atomically move it to a user-approved output path only after validation.

Refuse to overwrite an existing file unless the user explicitly authorizes replacement.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (45)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is presented as a CalDAV calendar sync/query capability, but the actual content documents an unrelated third-party multi-model AI gateway with broad outbound API usage. This mismatch is dangerous because it can mislead reviewers and users into granting or invoking a skill under false pretenses, enabling unexpected data flows and capabilities far beyond the declared purpose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Email sending and SMS/OTP verification are unrelated to CalDAV calendar sync/query and materially expand the skill into messaging and identity-verification operations. In this context, these capabilities could be abused for phishing, spam, OTP relay, or exfiltration of personal contact data under the cover of a benign calendar skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file advertises broad web search, scraping, and CEO interview retrieval capabilities that are materially unrelated to the stated CalDAV calendar sync/query purpose of the skill. This kind of capability mismatch increases the risk of covert data collection, scope expansion, or user deception because operators may invoke powerful external-retrieval features that were not expected from a calendar-focused integration.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documented tool models substantially exceed the stated CalDAV calendar scope and include unrelated outbound communication and AI utility capabilities. This kind of scope drift is dangerous because it expands the skill's effective authority, making it easier to misuse the skill for actions users would not reasonably expect, including sending messages or processing unrelated data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Email and SMS sending capabilities are high-risk outbound actions and are not justified by the declared CalDAV calendar function. If available to the agent, they could be abused to send messages, spam, phishing, or verification texts under the guise of a calendar tool, violating user expectations and least-privilege design.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill declares only Bash and Read tools, yet the documentation instructs users to perform extensive networked API interactions via curl to external services. This discrepancy obscures the true operational behavior and may cause users to underestimate network exposure, credential use, and third-party data transmission.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task. **Base URL:** `https://api.heybossai.com/v1` **Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"` ## List Models

Static analysis

No suspicious patterns detected.

Overview

A.I.G

other

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Description-Behavior Mismatch

Context-Inappropriate Capability

Description-Behavior Mismatch

Description-Behavior Mismatch

Context-Inappropriate Capability

Scope Creep

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis