Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a transparent local event-finding assistant, but it also asks to enable Google Calendar access and optional weekly automation that are not clearly declared in its top-level purpose.
Review this before installing if you do not want an event skill to access your calendar or run recurring scans. Only enable the Google Calendar connector if you are comfortable with availability lookups and explicit event creation, and only set up the weekly automation if you know how to review or disable it later.
Referenced artifact was not completely inspected
vent-scanner/`, `skills/local-event-scanner/`, or another path containing this `SKILL.md`). In this document, we refer to this path as `<skill_dir>`.
The document promises the skill will read and write only within its own folder, but the Google Calendar step directs the agent to perform an external side effect outside that boundary. This contradiction undermines containment assumptions and could cause unauthorized data transfer or account actions if a caller relies on the documented sandbox limits.
The manifest limits the skill to discovering and shortlisting local events and explicitly says it does not handle meeting planning. This file instructs the agent to create a Google Calendar event and confirm the created event details, which extends the skill into calendar-management behavior beyond discovery.
The invocation guidance says to use the skill when the user 'asks what's happening in their area,' which is a broad natural phrase that could match casual conversation outside the intended event-discovery context. The file does not provide explicit exclusions or negative examples to clarify when this phrase should not trigger the skill.
The skill requires creating and updating run-note files as part of normal execution, but it does not instruct the agent to disclose these writes to the user or obtain consent. Silent file creation can violate user expectations, especially in environments where workspace contents may be sensitive, persistent, or later consumed by other tools.
The skill metadata says it does not handle meeting planning, but it includes instructions to add events to Google Calendar. This creates a capability mismatch that can mislead users and orchestrators about the skill's actual side effects, increasing the chance of unexpected external actions being taken without appropriate consent or review.
The manifest says this skill is for discovering, scanning, and shortlisting local events and explicitly says it does not handle meeting planning. However, the operating model instructs the skill to add specific events to Google Calendar on request, which is a distinct action beyond discovery/shortlisting and outside the stated scope.
The skill context states it does not handle meeting planning, yet this file instructs the agent to create Google Calendar events when asked. Creating calendar entries is an action-oriented planning workflow that conflicts with the earlier declared boundary of the skill’s purpose.
The activation scope is broad and somewhat ambiguous because the step is framed as general setup and file configuration without strong gating on when it should be invoked. Ambiguity increases the chance that an agent enters a state-changing setup flow unnecessarily, leading to avoidable file modifications or prompting for extra permissions.
The setup step expands the skill from event discovery into calendar connector installation and event addition, which introduces account-access capabilities beyond the declared purpose. Even though the text says this occurs only if the user answers yes, it still broadens permissions and actions in a way users may not expect from a local event scanner.
Instructing the agent to enable a calendar connector gives the skill access to external account capabilities not required for merely discovering events. This creates unnecessary permission expansion and increases the risk of unintended data access or modification if the connector is over-scoped or later misused.
The setup step lacks a strong warning that enabling a calendar connector or creating automations can grant ongoing access or create recurring behavior. Because these actions affect external systems and future execution, failing to clearly disclose them undermines informed consent and increases the risk of user surprise or misuse.
The setup file instructs the agent to create a weekly automation, adding recurring autonomous behavior not described in the skill metadata. Recurring execution can continue to collect, process, or message content without a fresh user request, which materially changes the trust and safety profile of the skill.
The instruction to set up automations exceeds the stated purpose of discovering local events and adds a persistence mechanism that can trigger future actions without direct user initiation. This is dangerous because it normalizes expanded capability use and may surprise users with ongoing activity they did not associate with a one-time scanning skill.
The documented pipeline includes a dedicated calendar review step that checks user availability and practicality. While shortlist practicality is related to recommendations, the manifest does not mention access to calendar context and instead frames the skill as event discovery and matching, creating a scope mismatch at the intent level.
The file authorizes modifying user preference files but does not instruct the agent to warn the user before making those changes or summarize what will be edited. This can lead to silent or unexpected persistence of personal preferences, which is a trust and transparency issue even if the files are local to the skill.
No suspicious patterns detected.