Security audit
Security checks for vulnerabilities and agentic risk
The skill is a calendar-management helper, but it asks for broad agent routing and exec-style capabilities beyond clearly scoped calendar use.
Install only if you want an agent to manage calendar data through local commands and external calendar services. Before use, narrow activation to calendar tasks, require confirmation for creates, deletes, batch changes, exports, and attendee notifications, and only configure trusted HTTPS webhook destinations.
The skill is presented as a Google Calendar management tool, but it later advertises broad file-processing behavior unrelated to calendar operations. This scope expansion weakens the principle of least privilege and can cause an agent or user to invoke the skill for unintended tasks, increasing the chance of unauthorized data access or misuse.
The documentation broadens from calendar management into generic command execution and information retrieval, which materially changes the trust boundary of the skill. In an agent environment, this can lead to the skill being selected for unrelated tasks and used as a general-purpose execution surface with access beyond calendar data.
Listing generic system command execution as a core capability without clear calendar-specific limits creates a direct path to abuse if an agent maps user input into shell commands. Because the skill declares exec access, this ambiguity can result in arbitrary local command execution under the guise of calendar operations.
The skill claims commands should be whitelisted, but elsewhere it promotes unrestricted exec-style behavior as a core function. This inconsistency is dangerous because reviewers and agents cannot rely on the stated safety guidance when the rest of the document encourages broader execution semantics.
The activation guidance is so broad that it could match many unrelated AI, orchestration, or LLM-use requests rather than only calendar tasks. Overbroad routing increases the likelihood that the agent invokes this skill in inappropriate contexts, exposing exec-capable tooling and external integrations when they are not needed.
The skill documents create, export, batch operations, and attendee notifications without clear warnings that these actions can modify data or send communications. In an agent setting, insufficient disclosure around state-changing behavior raises the risk of unintended event creation, mass changes, or accidental attendee notifications.
The documented callback_url/webhook behavior can transmit calendar results to an external endpoint, but the skill does not clearly warn about privacy, data sensitivity, or trust requirements for the destination. This can lead to unintentional exfiltration of event metadata, attendee information, or scheduling details to third parties.
No suspicious patterns detected.
