Google Calendar

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:23 AM UTC
• Version: 0.1.0

Overview

This Google Calendar skill is mostly purpose-aligned, but it handles live OAuth tokens in an under-disclosed and insecure way that users should review before installing.

Review this skill before installing. Use it only with the minimum Google Calendar OAuth scope needed, avoid running the refresh_token.py helper unless you accept plaintext token storage, and prefer OpenClaw secrets or an OS credential store over ~/.config/google-calendar/secrets.env. Be careful with add, update, and delete commands because they can change calendar data immediately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/refresh_token.py:28

Finding

OAuth Access Token Exposed Through Standard Output and Insecure Plaintext Storage

Content

View full analysis

Vulnerability Details

File Location: scripts/refresh_token.py, lines 28–49
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code:

python

# Update the secrets.env file
env_path = os.path.expanduser('~/.config/google-calendar/secrets.env')
# Read existing lines, replace or add GOOGLE_ACCESS_TOKEN
lines = []
if os.path.exists(env_path):
    with open(env_path, 'r') as f:
        lines = f.readlines()
new_lines = []
token_set = False
for line in lines:
    if line.startswith('export GOOGLE_ACCESS_TOKEN='):
        new_lines.append(f'export GOOGLE_ACCESS_TOKEN={access_token}\n')
        token_set = True
    else:
        new_lines.append(line)
if not token_set:
    new_lines.append(f'export GOOGLE_ACCESS_TOKEN={access_token}\n')
with open(env_path, 'w') as f:
    f.writelines(new_lines)
print(json.dumps(resp_data, indent=2))

Technical Analysis

The OAuth access token returned by Google is written in plaintext to ~/.config/google-calendar/secrets.env. The script does not create the parent directory with restrictive permissions, explicitly set the file mode to 0600, verify existing file ownership, or perform an atomic replacement.

The entire OAuth response is also printed to standard output. Because the response contains access_token, the credential may be captured by terminal history tooling, agent transcripts, automation logs, CI logs, process wrappers, or redirected output files.

This behavior exceeds the minimum disclosure necessary for token refresh. Persisting an access token may be operationally useful, but printing it is unnecessary, and storage should use a protected secret-management mechanism.

The separate transmission of the client ID, client secret, and refresh token to https://oauth2.googleapis.com/token is expected OAuth behavior and is necessary for refresh-token exchange. No transmission to an unknown or attacker- ...[truncated 1220 chars]

Remediation

View remediation

Remediation Suggestions

• Do not print the complete OAuth response. Emit only non-sensitive status information, such as successful refresh and token expiry.
• Store the token using the documented OpenClaw secret-management facility instead of a plaintext environment file.
• If file storage is unavoidable, create the configuration directory with mode 0700 and the token file with mode 0600.
• Verify that an existing token file is a regular file owned by the current user and is not a symbolic link.
• Write to a securely created temporary file in the same directory, apply restrictive permissions, flush it, and atomically replace the destination.
• Avoid preserving access tokens longer than operationally necessary, and document revocation and rotation procedures.
• Ensure logs, exception handlers, and diagnostic output redact access_token, refresh_token, client_secret, and authorization headers.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:49

Finding

Unpinned and Unnecessary Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–52
Vulnerability Type: Unpinned third-party dependencies and avoidable supply-chain exposure
Risk Level: Low

Vulnerable Code:

markdown

5. Install the required Python packages (once):
   ```bash
   pip install --user google-auth google-auth-oauthlib google-api-python-client
   ```

Technical Analysis

The setup documentation instructs users to install three packages from the default Python package index without fixed versions, hashes, or a reviewed lockfile. Package resolution therefore depends on mutable registry state at installation time.

The audited scripts use Python standard-library modules rather than these packages. Consequently, this installation instruction introduces supply-chain exposure that is not necessary for the supplied implementation. Installation with --user also places packages in the user environment, where they may affect other Python programs.

The audit did not identify evidence that the named packages are malicious. The issue is the unnecessary and non-reproducible installation process rather than a confirmed malicious dependency.

Attack Path

1. A user follows the setup instructions and runs the documented pip install --user command.
2. Pip resolves whichever package releases and transitive dependencies are current at that time.
3. If a package account, release artifact, dependency, package index, or network trust path is compromised, malicious installation or package code is delivered.
4. That code executes with the privileges of the user performing installation or later importing the package.
5. It may access files, environment variables, or credentials available to that user, including Google OAuth secrets if they are present in the environment.

Impact Assessment

Successful supply-chain compromise would provide code execution in the installing user's context. Potential exposure includes use ...[truncated 272 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the installation step if the implementation continues to rely exclusively on Python’s standard library.
• If third-party packages become necessary, pin exact direct and transitive versions in a reviewed lockfile.
• Require package hashes, such as through a hash-locked requirements file and pip install --require-hashes.
• Install dependencies in an isolated virtual environment rather than the shared user package directory.
• Review dependency provenance, release history, maintainers, and vulnerability advisories before updates.
• Keep the documentation synchronized with the actual implementation so users are not asked to install unused software.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tainted flow: 'req' from os.getenv (line 17, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/refresh_token.py (reported line 20)May include surrounding context.

python

req = urllib.request.Request('https://oauth2.googleapis.com/token', data=data, method='POST')
    req.add_header('Content-Type', 'application/x-www-form-urlencoded')
    try:
        with urllib.request.urlopen(req) as resp:
            resp_data = json.load(resp)
    except urllib.error.HTTPError as e:
        sys.stderr.write(f'HTTP error {e.code}: {e.read().decode()}\n')

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

text

## How it works (brief)
The script loads the credentials from the environment, refreshes the access token using the refresh token, builds a `service = build('calendar', 'v3', credentials=creds)`, and then calls the appropriate API method.

## References
- Google Calendar API reference: https://developers.google.com/calendar/api/v3/reference

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The code stores an access token in a plaintext secrets file under the user's home directory without setting secure permissions or using a protected secret store. This creates credential exposure risk through local file disclosure, backups, shell tooling, or permissive default umasks; in a skill context, persistent local storage of live tokens increases the blast radius beyond a single execution.

Content

Scanner excerpt · scripts/refresh_token.py (reported line 29)May include surrounding context.

python

if not access_token:
        sys.stderr.write('No access_token in response\n')
        sys.exit(1)
    # Update the secrets.env file
    env_path = os.path.expanduser('~/.config/google-calendar/secrets.env')
    # Read existing lines, replace or add GOOGLE_ACCESS_TOKEN
    lines = []

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Using a fixed path for a plaintext secrets file in the home directory encourages persistent credential storage in a location that may be accessible to other local users, processes, or backup systems. The danger is amplified because the script writes refreshed live access tokens there automatically, making compromise of that file immediately useful for unauthorized calendar API access.

Content

Scanner excerpt · scripts/refresh_token.py (reported line 30)May include surrounding context.

python

sys.stderr.write('No access_token in response\n')
        sys.exit(1)
    # Update the secrets.env file
    env_path = os.path.expanduser('~/.config/google-calendar/secrets.env')
    # Read existing lines, replace or add GOOGLE_ACCESS_TOKEN
    lines = []
    if os.path.exists(env_path):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill requests or implies access to environment secrets, local files, and outbound network access, but the manifest does not declare any explicit tool scope or allowed-tools restrictions. In an agent environment, this increases the blast radius because the skill can potentially read sensitive credentials and make external API calls without clear least-privilege boundaries or operator visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill performs state-changing calendar actions (add, update, delete) immediately based on command-line input, with no built-in confirmation, dry-run mode, or guardrails against accidental invocation. In an agent context, this increases the risk of unintended modification or deletion of calendar data if the model misunderstands user intent, is prompt-injected, or is given ambiguous instructions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes interacting with Google Calendar to list, create, update, and delete events. This script additionally pulls client credentials and a refresh token from process environment variables, which is credential-management behavior rather than calendar interaction itself; that capability is not stated in the skill purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The request body includes client_secret and refresh_token and sends them to Google's token endpoint. While this is functionally expected for token refresh, the file itself provides no user-facing disclosure that sensitive environment credentials will be transmitted over the network.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest says the skill interacts with Google Calendar to list, create, update, and delete calendar events. This file instead calls Google's OAuth token endpoint to mint a new access token and updates a local secrets file, which is distinct authentication and credential-storage behavior not reflected in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script silently writes a refreshed access token into a local secrets file, which changes persisted credentials without any confirmation, permission hardening, or integrity checks. In an agent-skill context, silent secret mutation is more dangerous because users may not expect background credential storage and the file may be readable by other local processes or users depending on filesystem permissions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.