T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/google-calendar-cli.py:225- Finding
OAuth Credentials Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
py-googlecalendar-cli
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real Google Calendar CLI, but it handles long-lived OAuth secrets unsafely and can modify or delete live calendar events without clear guardrails.
Review before installing. Use only with a Google account and calendar you are comfortable letting an agent read and change. Prefer environment variables or a proper secret store, avoid passing refresh tokens or client secrets as command-line flags, and require explicit user confirmation before update or delete commands.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Auth ──────────────────────────────────────────────────────────────────── def obtain_access_token(client_id, client_secret, refresh_token): """Exchange a refresh token for a short-lived access token.""" body = urllib.parse.urlencode({ "client_id": client_id, "client_secret": client_secret,
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # ── Auth ──────────────────────────────────────────────────────────────────── def obtain_access_token(client_id, client_secret, refresh_token): """Exchange a refresh token for a short-lived access token.""" body = urllib.parse.urlencode({ "client_id": client_id, "client_secret": client_secret,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file describes commands that create, update, and delete Google Calendar events, including a delete command, but does not include any warning that these actions modify user data or may be irreversible. Under the markdown-specific SQP-2 criteria, skill descriptions should warn about behaviors that could affect user data or system integrity.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill explicitly requires environment secrets and network access to Google Calendar, but it does not declare an explicit tool scope such as permissions or allowed-tools. That mismatch weakens governance and user awareness, making it easier for an agent to invoke credentialed network actions without clear policy boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises update and delete operations against a live calendar but provides no warning, confirmation guidance, or safety notes about destructive changes. In an agent setting, this increases the risk of accidental event modification or deletion, potentially causing data loss, scheduling disruption, or unauthorized changes if invoked carelessly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI accepts OAuth client secret and refresh token directly via command-line flags, which can expose them through shell history, process listings, audit logs, or job runners. In a calendar-management tool, these credentials grant API access to private calendar data and event modification, so disclosure can lead to unauthorized access and tampering.
- Content