py-googlecalendar-cli

Tiny and short Python CLI tool to manage Google Calendar events from the command line -- list, add, update, delete events via the Calendar API.

Security Scan

The skill's code, instructions, and credential requirements align with a simple Google Calendar CLI; nothing indicates hidden exfiltration or unrelated access, though the registry metadata vs SKILL.md show a small metadata inconsistency.

Purpose & Capability

The name/description match the included Python CLI which calls the Google Calendar API. The tool legitimately requires OAuth client_id, client_secret, and a refresh_token; however the registry-level 'Requirements' block listed no required env vars while SKILL.md metadata and the script clearly require GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN (and optionally GOOGLE_CALENDAR_ID). This metadata mismatch is not dangerous but is an inconsistency to be aware of.

Instruction Scope

SKILL.md only instructs obtaining OAuth credentials, exporting env vars or passing flags, and running the provided Python script. The script only calls Google OAuth and the Google Calendar API endpoints and does not reference other files, system credentials, or unexpected network endpoints.

Install Mechanism

There is no install spec or third-party download; code is provided in the package and uses only the Python standard library. No archive downloads, package manager installs, or external installers are present.

Credentials

The required environment variables (client id, client secret, refresh token, calendar id) are directly necessary for OAuth-based access to Google Calendar. No unrelated secrets or extra credentials are requested.

Persistence & Privilege

The skill is not forced-always, has default autonomous-invocation settings, and does not request system-wide configuration or modify other skills. It does not request elevated or persistent system privileges.

Assessment

This looks like a straightforward Google Calendar CLI. Before installing: (1) verify the GitHub source (homepage) and review the script yourself — the package contains the full Python file; (2) only provide OAuth client_id, client_secret, and refresh_token if you trust the code and host — a refresh token grants ongoing access to your calendar and should be protected; (3) consider creating a dedicated OAuth client and consenting only the minimum scopes, and be prepared to revoke the refresh token if anything seems off; (4) run the script locally first (not on a shared agent) to confirm behavior; and (5) note the minor metadata inconsistency (registry said no envs while SKILL.md requires them) — this is likely an authoring oversight rather than malicious behavior.

Google Calendar CLI

A single-file CLI for Google Calendar using only Python 3 standard library.

Setup

1. Create a Google Cloud project and enable the Google Calendar API.
2. Create OAuth 2.0 credentials (Desktop app). Note the client ID and secret.
3. Obtain a refresh token via the OAuth consent flow.
4. Export credentials:

   export GOOGLE_CLIENT_ID=...
   export GOOGLE_CLIENT_SECRET=...
   export GOOGLE_REFRESH_TOKEN=...
   export GOOGLE_CALENDAR_ID=primary  # optional, defaults to "primary"
   

Usage

google-calendar-cli.py <command> [options]

Command	Description
list	List upcoming events
today	Show today's events
add	Create a new event
update	Update an existing event
delete	Delete an event

Credentials can also be passed as flags (--client-id, --client-secret, --refresh-token, --calendar-id).

Use --json for raw JSON output. Run with -h for full help.

Examples

# List next 10 events
python3 {baseDir}/scripts/google-calendar-cli.py list

# Today's events
python3 {baseDir}/scripts/google-calendar-cli.py today

# Events in a date range
python3 {baseDir}/scripts/google-calendar-cli.py list --from 2025-06-01T00:00:00Z --to 2025-06-30T23:59:59Z

# Add an event
python3 {baseDir}/scripts/google-calendar-cli.py add --title "Meeting" \
    --start 2025-06-01T09:00:00-07:00 --end 2025-06-01T10:00:00-07:00

# Update an event
python3 {baseDir}/scripts/google-calendar-cli.py update --event-id EVENT_ID --title "New Title"

# Delete an event
python3 {baseDir}/scripts/google-calendar-cli.py delete --event-id EVENT_ID