Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent for calendar time-blocking, but it can create and delete Google Calendar events without clear confirmation, limits, or rollback safeguards.
Review this skill carefully before installing. It is not evidence of malware, but you should only use it if you are comfortable granting it Google Tasks and primary-calendar access, and you should require preview/confirmation plus a rule that it may only delete events it created.
The SOP explicitly instructs autonomous creation and deletion of calendar events without an upfront user warning or explicit consent step for modifying calendar data. In this context, the danger is elevated because the workflow not only writes new events but may also delete events during overlap resolution, creating a real risk of unintended data loss or disruption to the user's schedule.
The activation condition is broad enough to trigger on common scheduling or assistant-style requests, which can cause the skill to engage in calendar-modifying behavior outside a narrowly intended context. Because this SOP proceeds toward autonomous scheduling and later deletion/remediation actions, an accidental match increases the chance of unintended task processing and calendar changes.
No suspicious patterns detected.
