ClawHub
Back to skill

Security audit

Gcal Cli

Security checks for vulnerabilities and agentic risk

Overview

The skill provides calendar management and meeting preparation with disclosed data access and clear owner control over changes and reminders.

Choose the intended profile and enable write or sharing access only when needed. Meeting briefs can include private communications already stored by other WireCat tools. MCP changes may run without another confirmation, so requests should identify the exact change. Reminder timers remain owner-installed. This review covers the skill instructions; the separately installed CLI was not audited.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

The skill exposes general search of other tools' messages, notes, and meeting transcripts beyond its declared Google Calendar scope.

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

L068–L071 instruct the agent to search a shared store containing messages from other WireCat tools and notes, with meeting transcripts available by selecting a meeting account. Although attendee-related context is reasonably needed for meeting briefs, this general cross-tool search is not restricted to calendar events or their participants and goes beyond the manifest's stated Calendar-focused search capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md
is coming: use `events list`, or `events remind --dry-run --json`, which changes nothing. Its program form
  (`-- <program>`) needs `events.remind.hook`, which only the owner allows; never set it yourself.
- `schedule command <name> --every 5m -- events remind … -- <program>` installs the owner's reminder timer (systemd,
  launchd or Task Scheduler). Only the owner installs or removes one; MCP does not offer `schedule`, and
  `GCAL_READ_ONLY` refuses it. Show the owner the command instead of running it.

## Prepare a meeting brief

Static analysis

No suspicious patterns detected.