py-googlecalendar-cli

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:39 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Google Calendar CLI, but it handles long-lived OAuth secrets unsafely and can modify or delete live calendar events without clear guardrails.

Review before installing. Use only with a Google account and calendar you are comfortable letting an agent read and change. Prefer environment variables or a proper secret store, avoid passing refresh tokens or client secrets as command-line flags, and require explicit user confirmation before update or delete commands.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/google-calendar-cli.py:225
• Finding: OAuth Credentials Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/google-calendar-cli.py`, lines 225-227 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Medium ### Vulnerable Code ```python parser.add_argument("--client-id", help="Google OAuth client ID (or GOOGLE_CLIENT_ID)") parser.add_argument("--client-secret", help="Google OAuth client secret (or GOOGLE_CLIENT_SECRET)") parser.add_argument("--refresh-token", help="Google OAuth refresh token (or GOOGLE_REFRESH_TOKEN)") ``` The insecure command-line credential mechanism is also explicitly documented in `README.md` and `SKILL.md`, increasing the likelihood that users will use it. ### Technical Analysis The CLI accepts the Google OAuth client secret and refresh token as command-line arguments. Command-line arguments may be exposed through: - Shell command history. - Process inspection facilities and process-monitoring tools. - Endpoint telemetry, audit logs, or job-runner logs that record complete commands. - CI/CD logs or automation configuration. - Diagnostic output collected by system administrators. A Google OAuth refresh token is a long-lived credential that can be exchanged for short-lived access tokens. Possession of the refresh token, together with the applicable OAuth client credentials, may allow an attacker to repeatedly obtain access tokens until the refresh token is revoked or otherwise invalidated. The application also supports environment variables, but retaining and documenting secret-bearing CLI flags creates an avoidable exposure path. The network transmission itself is necessary for the declared functionality and is restricted to the official HTTPS Google endpoints `oauth2.googleapis.com` and `www.googleapis.com`; no undisclosed destination was identified. ### Attack Path 1. A user follows the documented option and invokes the CLI with `--client-secret` and `--refresh-token`. 2. The complete command is retained in shell ...[truncated 1402 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--client-secret` and `--refresh-token` command-line options so long-lived secrets cannot be supplied through process arguments. 2. Prefer an operating-system credential store or secret manager with access controls and auditability. 3. If interactive entry is required, use Python's `getpass.getpass()` so the secret is not echoed or included in command history. 4. For automation, support reading secrets from protected files or inherited file descriptors. Require restrictive file permissions and avoid printing secret values. 5. Environment variables may remain as a compatibility mechanism, but documentation should explain that they can still be exposed through process environments, crash diagnostics, or CI configuration. 6. Update `README.md`, `SKILL.md`, and CLI help text to remove examples or recommendations that encourage passing secrets as flags. 7. Never include OAuth credentials or token-endpoint response bodies in logs. Consider sanitizing authentication errors before displaying them. 8. Advise affected users to remove credential-bearing commands from shell history and revoke or rotate any refresh tokens and client secrets previously passed on the command line. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

# ── Auth ────────────────────────────────────────────────────────────────────

def obtain_access_token(client_id, client_secret, refresh_token):
    """Exchange a refresh token for a short-lived access token."""
    body = urllib.parse.urlencode({
        "client_id": client_id,
        "client_secret": client_secret,

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# ── Auth ────────────────────────────────────────────────────────────────────

def obtain_access_token(client_id, client_secret, refresh_token):
    """Exchange a refresh token for a short-lived access token."""
    body = urllib.parse.urlencode({
        "client_id": client_id,
        "client_secret": client_secret,

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This markdown file describes commands that create, update, and delete Google Calendar events, including a delete command, but does not include any warning that these actions modify user data or may be irreversible. Under the markdown-specific SQP-2 criteria, skill descriptions should warn about behaviors that could affect user data or system integrity.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly requires environment secrets and network access to Google Calendar, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens governance and user awareness, making it easier for an agent to invoke credentialed network actions without clear policy boundaries.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises update and delete operations against a live calendar but provides no warning, confirmation guidance, or safety notes about destructive changes. In an agent setting, this increases the risk of accidental event modification or deletion, potentially causing data loss, scheduling disruption, or unauthorized changes if invoked carelessly.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The CLI accepts OAuth client secret and refresh token directly via command-line flags, which can expose them through shell history, process listings, audit logs, or job runners. In a calendar-management tool, these credentials grant API access to private calendar data and event modification, so disclosure can lead to unauthorized access and tampering.

Static analysis

No suspicious patterns detected.