Security audit

Google Calendar (via gcalcli)

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its calendar-management purpose, but it should be reviewed because it can delete or edit calendar events without a second confirmation and its shell command templates are not safely scoped against injected calendar text.

Install only if you are comfortable letting the agent make Google Calendar changes through your local gcalcli OAuth profile. Prefer requiring confirmation before any delete/edit action, and avoid using raw shell command strings with untrusted event titles, calendar names, or queries; a safer implementation should pass gcalcli arguments as structured argv and escape ICS fields correctly.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:116
Finding: Shell Command Injection Through Unescaped Calendar Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 116-118, 130-138, and 153 **Vulnerability Type**: Shell command injection through unsafe interpolation **Risk Level**: High ### Vulnerable Code ```sh gcalcli --nocolor --calendar "<Cal>" add --noprompt --title "<Title>" --when "<Start>" --duration <minutes> gcalcli --nocolor --calendar "<Cal>" add --noprompt --allday --title "<Title>" --when "<Date>" ``` ```sh echo 'BEGIN:VCALENDAR VERSION:2.0 BEGIN:VEVENT DTSTART;VALUE=DATE:20260308 SUMMARY:Event Title RRULE:FREQ=YEARLY TRANSP:TRANSPARENT END:VEVENT END:VCALENDAR' | gcalcli import --calendar "<Cal>" ``` ```sh gcalcli --nocolor delete --iamaexpert "<query>" <start> <end> ``` ### Technical Analysis The Skill directs the agent to interpolate calendar names, event titles, dates, search queries, durations, and generated ICS content into shell command strings. It does not require argument-array execution, strict input validation, or shell-safe escaping. Double quotes do not neutralize all shell syntax. If a dynamic value contains a double quote followed by shell operators, it may terminate the intended argument and append another command. The multiline `echo` pattern is also unsafe when generated ICS data contains a single quote, because that character can terminate the shell's single-quoted string. The risk applies to values supplied directly by a user and potentially to text retrieved from calendar events and later reused in commands. Whether exploitation succeeds depends on the execution tool invoking these templates through a shell. If commands are executed as structured argument arrays without shell parsing, the shell-injection path is prevented. The ICS template has an additional data-integrity concern: dynamically generated text fields should be escaped according to RFC 5545, independently of shell escaping. ### Attack Path 1. An attacker supplies an event title, calendar name, or deletion query containing quote-breaking charact ...[truncated 1344 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require execution through a structured process API that accepts an executable and argument array, without invoking a shell. For example, pass `gcalcli`, `--calendar`, the calendar name, and other values as separate arguments. 2. Explicitly prohibit constructing shell command strings from user-controlled or calendar-derived data. 3. If shell execution is unavoidable, apply robust, platform-specific shell escaping to every dynamic argument. Simple quote replacement is insufficient. 4. Replace the `echo '...' | gcalcli import` pattern with direct stdin delivery through the process execution API. 5. Escape dynamic ICS properties according to RFC 5545, including backslashes, commas, semicolons, and line breaks where applicable. 6. Validate numeric durations with a strict integer allowlist or range. 7. Parse and validate dates and times before execution rather than accepting arbitrary shell text. 8. Treat calendar names, event titles, search terms, and existing event content as untrusted input, even when they originate from Google Calendar rather than the current user. ]]>

T08 · Insecure Dependencies

Warning

Location: README.md:16
Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, line 16 **Vulnerability Type**: Unpinned dependency and mutable supply-chain source **Risk Level**: Medium ### Vulnerable Code ```text - `gcalcli` — install via `pip install gcalcli` or `brew install gcalcli` ``` ### Technical Analysis The installation instructions request the latest package available from a package manager without specifying a reviewed version, cryptographic hash, lockfile, or other integrity constraint. As a result, installations performed at different times may retrieve different code than the version considered during this audit. This does not establish that `gcalcli` is malicious. The risk arises from mutable dependency resolution: a compromised upstream release, publisher account, package registry, formula, or transitive dependency could introduce code that was not reviewed with the Skill. Because package installation can execute package-controlled build or installation logic, dependency compromise may affect the local environment before the calendar client is used. ### Attack Path 1. A user follows the documented prerequisite and runs the unpinned installation command. 2. The package manager resolves the current package and its dependencies at installation time. 3. An upstream package, release account, registry entry, formula, or transitive dependency has been compromised or has changed unexpectedly. 4. Unreviewed code is installed and may execute during installation or subsequent `gcalcli` use. 5. The compromised component gains access to resources available to the user running it, including calendar data and locally stored OAuth credentials. ### Impact Assessment A compromised dependency could execute with the privileges of the installing user or the account invoking `gcalcli`. Potential impact includes: - Theft of locally stored Google OAuth tokens. - Unauthorized access to calendar contents. - Unauthorized creation, alteration, or deletion of events. - Acces ...[truncated 275 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin `gcalcli` to a specific version that has been reviewed and tested with the Skill. 2. For Python installations, use a requirements or lock file with cryptographic hashes where practical. 3. Document the expected official package name, publisher, and source repository to reduce typosquatting risk. 4. Pin or lock relevant transitive dependencies when reproducible deployment is required. 5. Recommend installation inside an isolated virtual environment or similarly constrained runtime. 6. Establish a documented update process that reviews and tests new dependency versions before changing the pin. 7. Where supported, verify downloaded artifacts or package metadata against trusted signatures or checksums. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: **This skill intentionally skips user confirmation for unambiguous destructive actions (delete/edit).** This is a deliberate UX decision, not an oversight. Here's why and how it's kept safe: ### Why skip confirmation? This skill is designed for personal assistant use via messaging apps (Telegram, WhatsApp, etc.), where: - The user has already stated their intent explicitly (e.g. "delete my dentist appointment on Thursday").
Confidence: 95% confidence
Finding: The README states that the skill intentionally skips user confirmation for unambiguous destructive actions such as delete and edit. Even if framed as a UX decision, this delegates destructive authority to the agent and increases the chance of accidental or manipulated actions when event matching, time interpretation, or user intent resolution is wrong.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ### Safety guards in place The skill does NOT blindly delete. All of these must hold before executing without confirmation: 1. **Explicit user request** — the user must have asked for the action in their message. 2. **Single unambiguous match** — exactly one event matches in a tight, bounded time window.
Confidence: 89% confidence
Finding: The skill explicitly permits deletion of calendar events without a separate confirmation step once it decides the request is explicit and the match is unambiguous. That creates autonomous destructive behavior based on the agent's interpretation of natural language, which can fail due to ambiguity, misparsing, or adversarial prompting, leading to unintended event deletion.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 1. **Explicit user request** — the user must have asked for the action in their message. 2. **Single unambiguous match** — exactly one event matches in a tight, bounded time window. 3. **Post-action verification** — after every delete, the agent verifies via agenda that the event is actually gone. It never claims success without verification. 4. **Disambiguation for ambiguous cases** — if multiple events match, the agent always stops and asks the user to choose before proceeding. 5. **Overlap checks for creates** — before creating events, the agent checks for scheduling conflicts across all calendars and asks for confirmation if an overlap exists.
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly allows delete/edit actions to proceed without a user-facing confirmation when it deems the match unambiguous. Even with bounded windows and post-delete verification, a mistaken match, ambiguous natural-language interpretation, or stale calendar state could cause irreversible deletion of the wrong event.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: This skill is designed for personal assistant use where the user expects fast, low-friction calendar management. The confirmation policy below is an intentional UX choice — see README.md for rationale and safety guards. ### Unambiguous actions: execute immediately For cancel/delete/edit actions, skip confirmation when ALL of these hold: - The user explicitly requested the action (e.g. "delete my dentist appointment"). - Exactly one event matches in a tight time window. - The match is unambiguous (single clear result on an exact date, or user specified date+time).
Confidence: 91% confidence
Finding: This is a genuine autonomy risk: the skill instructs the agent to skip confirmation for destructive actions based on its own determination of unambiguity. In a calendar tool, misresolution of dates, titles, or duplicate events can directly lead to unintended deletions or delete-and-recreate modifications.

Natural-Language Policy Violations

Low

Confidence: 92% confidence
Finding: The instruction "Don't mix languages within one reply" imposes a language-format constraint regardless of user preference. Under the policy, language or locale constraints should either offer user choice or be clearly justified as region-specific, which is not present here.

Scope Creep

Low

Category: Excessive Agency
Content: - Don't quote event titles unless needed to disambiguate. ### Calendar scope - Trust gcalcli config (default/ignore calendars). Don't broaden scope unless user asks "across all calendars" or results are clearly wrong. ### Agenda (today-only by default) - If user asks "agenda" without a period, return today only.
Confidence: 75% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.