Security audit
Security checks for vulnerabilities and agentic risk
The skill is narrowly focused on deleting Google Calendar events, but it tells the agent to run a destructive delete command without requiring confirmation or event verification.
Only install this if you are comfortable with an agent deleting Google Calendar events through `gog`. Before use, require the agent to identify the exact calendar and event, restate what will be deleted, and get explicit confirmation before running the command.
The skill exposes a destructive command that permanently removes calendar events but provides no warning about its irreversible nature, no preconditions, and no operator guidance for safe use. In an automation context, the absence of warnings and safeguards materially increases the chance of accidental data loss and unsafe invocation by an LLM-based agent.
The trigger condition 'When an event needs to be removed or deleted from the calendar' is overly broad and does not require explicit user confirmation, identity verification of the target event, or any safety checks before executing a destructive action. In an agentic setting, this ambiguity can cause accidental or unauthorized deletion of calendar events from natural-language requests, inferred intent, or malformed upstream context.
No suspicious patterns detected.
