ClawHub
Back to skill

Security audit

Quick Google Calendar Command Line Interface

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Google Calendar purpose, but it gives agents unsafe command patterns and allows calendar deletes or edits without a final confirmation.

Install only if you are comfortable letting the agent use authenticated gcalcli to read, create, edit, and delete your Google Calendar events. Before use, consider changing the policy to require confirmation for all deletes and edits, use gcalcli init instead of putting OAuth secrets on a command line, pin the gcalcli version, and ensure commands are executed with safely separated arguments rather than shell-interpolated strings.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:131
Finding
Shell Command Injection Through User-Controlled Calendar Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 131-139, 148, and 157-164 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash gcalcli --nocolor --calendar "<Cal>" add --noprompt --title "<Title>" --when "<Start>" --duration <minutes> gcalcli --nocolor --calendar "<Cal>" add --noprompt --allday --title "<Title>" --when "<Date>" ``` ```bash echo 'BEGIN:VCALENDAR VERSION:2.0 BEGIN:VEVENT DTSTART;VALUE=DATE:20260308 SUMMARY:Event Title RRULE:FREQ=YEARLY TRANSP:TRANSPARENT END:VEVENT END:VCALENDAR' | gcalcli import --calendar "<Cal>" ``` ```bash gcalcli --nocolor delete --iamaexpert "<query>" <start> <end> ``` ### Technical Analysis The Skill instructs the agent to interpolate conversationally supplied calendar names, event titles, dates, times, durations, and search queries into shell command strings. It does not require argument-array execution, escaping, validation, or another mechanism that prevents shell interpretation. Double quotes do not neutralize all shell syntax. Command substitutions such as `$(command)` and backticks can still execute inside double-quoted arguments. A quotation mark may also terminate the expected argument and introduce shell operators. In the ICS example, event data is placed inside a single-quoted `echo` operand; an apostrophe in generated content can terminate that operand and alter the resulting command. The issue applies when an execution environment passes the constructed command through a shell. If the execution tool uses a direct process API with separately encoded arguments, shell injection would be prevented, but the Skill does not mandate that safer execution model. ### Attack Path 1. An attacker causes the user or agent to process a crafted calendar name, event title, or deletion query. 2. The value includes shell metacharacters or command substitution, such as `$(attacker-command)`. 3. The agent substitutes the value into one of the documented com ...[truncated 713 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Invoke `gcalcli` through a direct process API using a separately encoded argument array; do not concatenate a command string or invoke a shell. - Treat calendar names, titles, queries, and generated ICS fields as untrusted data. - Validate dates, times, and durations against strict formats and numeric bounds. - Supply ICS data directly through the child process's standard input rather than constructing an `echo` pipeline. - Do not rely on double quotes or ad hoc escaping as the primary defense. - If shell execution is unavoidable, use a well-tested platform-specific escaping library and reject unexpected control characters, shell metacharacters, and line breaks. - Add explicit Skill instructions prohibiting shell evaluation of user-controlled calendar data. - Test titles and queries containing apostrophes, quotation marks, dollar signs, backticks, semicolons, pipes, newlines, and command-substitution syntax. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
README.md:19
Finding
OAuth Client Secret Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 19-24 **Vulnerability Type**: Sensitive credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash gcalcli --client-id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com --client-secret=GOCSPX-xxxxxxxxxxxxxxxxxxxxxxxxxxxx list ``` ### Technical Analysis The setup documentation instructs users to provide the Google OAuth client secret directly as a command-line argument. When replaced with a real credential, the secret may be retained in shell history, terminal transcripts, process-monitoring records, diagnostic telemetry, audit logs, or command-line process listings. Masking the example value does not prevent the exposure because users are expected to substitute their actual secret when following the command. ### Attack Path 1. A user replaces the placeholder with a real OAuth client secret. 2. The user executes the documented command. 3. The shell records the command in its history, or local process and logging facilities capture its arguments. 4. Another local principal, support operator, monitoring system, or log reader obtains the recorded command. 5. The exposed client secret can be reused outside the intended setup process. ### Impact Assessment The exposed value is an OAuth application client secret. Disclosure compromises the confidentiality of that application credential and may enable impersonation of the OAuth client in contexts where Google accepts the secret. The client secret alone does not necessarily provide direct access to the user's calendar without an authorization code, refresh token, or other OAuth material. Nevertheless, exposure weakens the OAuth trust boundary and may facilitate phishing, client impersonation, or abuse when combined with other compromised credentials. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions - Prefer `gcalcli init` or another interactive initialization flow that does not place secrets in process arguments. - Store the client secret in a permission-restricted configuration file or supported operating-system secret store. - If `gcalcli` supports reading the value from standard input or a protected environment mechanism, document that method instead. - Add an explicit warning that real secrets must not be pasted into command lines. - Instruct affected users to remove exposed commands from shell history and relevant logs. - Recommend rotating the OAuth client secret if it has already been entered through the documented command. - Document restrictive file permissions for any local credential or token files. ]]>

T08 · Insecure Dependencies

Warning
Location
README.md:14
Finding
Unpinned Third-Party Package Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 14-17 **Vulnerability Type**: Dependency supply-chain weakness **Risk Level**: Medium ### Vulnerable Code ```text - Python 3.6+ - `gcalcli` — install via `pip install gcalcli` or `brew install gcalcli` - Google Calendar OAuth2 credentials (set up via `gcalcli init` or `gcalcli list` on first run) ``` ### Technical Analysis The installation instructions do not pin `gcalcli` to a reviewed version or verify package integrity. The `pip install gcalcli` command resolves the current package and its transitive dependencies from the configured package index at installation time. The Homebrew instruction similarly does not identify a reviewed package revision. This does not prove that `gcalcli` is malicious. The risk is that a future compromised, replaced, or unexpectedly changed upstream release would be installed without review. Because the package handles OAuth tokens and calendar content, compromise of this dependency would affect sensitive data and authorized calendar operations. ### Attack Path 1. An upstream package release, package-index account, distribution artifact, or transitive dependency is compromised. 2. A user follows the unpinned installation instruction. 3. The package manager resolves and installs the compromised version. 4. Malicious code executes during installation or when `gcalcli` is subsequently invoked. 5. The code gains the access available to the local user and the authenticated calendar client. ### Impact Assessment A compromised dependency could execute code with the installing user's privileges. It could read local files, access `gcalcli` configuration and OAuth tokens, collect calendar event data, alter or delete accessible events, or transmit sensitive information over the network. The potential calendar scope includes all calendars authorized by the locally stored OAuth credentials. Operating-system impact remains bounded by the privileges and sandbox of ...[truncated 53 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin `gcalcli` to a specific version that has been reviewed and tested with the Skill. - For Python installation, provide a locked requirements file with cryptographic hashes and recommend `pip install --require-hashes`. - Pin and review relevant transitive dependencies where practical. - Identify the expected package index or official distribution source explicitly. - For Homebrew, document the expected official formula and a reviewed version or revision. - Establish a dependency-update process that reviews release notes, source changes, provenance, and security advisories before changing the approved version. - Run the calendar client with only the local and OAuth permissions needed for calendar management. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
**This skill intentionally skips user confirmation for unambiguous destructive actions (delete/edit).** This is a deliberate UX decision, not an oversight. Here's why and how it's kept safe:

### Why skip confirmation?

This skill is designed for personal assistant use via messaging apps (Telegram, WhatsApp, etc.), where:
Confidence
96% confidence
Finding
The documented policy to skip confirmation for unambiguous destructive actions is a real autonomy risk. In a calendar-management skill, deletion and edits can have meaningful real-world consequences, and relying on the agent's own ambiguity judgment creates a failure mode where one misinterpreted natural-language request results in unauthorized or unintended destructive changes.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
### Safety guards in place

The skill does NOT blindly delete. All of these must hold before executing without confirmation:

1. **Explicit user request** — the user must have asked for the action in their message.
2. **Single unambiguous match** — exactly one event matches in a tight, bounded time window.
Confidence
92% confidence
Finding
The README explicitly endorses autonomous execution of destructive calendar actions without a separate confirmation step when the agent judges the match to be unambiguous. Even with bounded search and post-delete verification, a mistaken match, parsing error, or adversarially phrased request can cause irreversible deletion of a legitimate event before the user has a chance to stop it.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. **Explicit user request** — the user must have asked for the action in their message.
2. **Single unambiguous match** — exactly one event matches in a tight, bounded time window.
3. **Post-action verification** — after every delete, the agent verifies via agenda that the event is actually gone. It never claims success without verification.
4. **Disambiguation for ambiguous cases** — if multiple events match, the agent always stops and asks the user to choose before proceeding.
5. **Overlap checks for creates** — before creating events, the agent checks for scheduling conflicts across all calendars and asks for confirmation if an overlap exists.
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly authorizes immediate delete/edit actions without a separate user-facing confirmation when it deems the match unambiguous. In a calendar-management context, this creates a real risk of irreversible or hard-to-recover destructive actions if the tool output is stale, matching is wrong, or the user phrased the request ambiguously but the agent overconfidently interprets it as unique.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
This skill is designed for personal assistant use where the user expects fast, low-friction calendar management. The confirmation policy below is an intentional UX choice — see README.md for rationale and safety guards.

### Unambiguous actions: execute immediately
For cancel/delete/edit actions, skip confirmation when ALL of these hold:
- The user explicitly requested the action (e.g. "delete my dentist appointment").
- Exactly one event matches in a tight time window.
- The match is unambiguous (single clear result on an exact date, or user specified date+time).
Confidence
95% confidence
Finding
This is a genuine autonomous-action risk: the skill tells the agent to skip confirmation for cancel/delete/edit operations based on its own assessment of ambiguity. Because those actions alter or remove user data, the danger comes from model misresolution, stale calendar state, or semantic matching errors causing unintended modifications without a final human check.

Natural-Language Policy Violations

Low
Confidence
81% confidence
Finding
The instruction "Don't mix languages within one reply" imposes a language-handling constraint in natural language, but does not clarify that the response language should follow user preference or provide a choice. Under the policy, locale or language constraints should be user-directed or explicitly justified.

Scope Creep

Low
Category
Excessive Agency
Content
- Don't quote event titles unless needed to disambiguate.

### Calendar scope
- Trust gcalcli config (default/ignore calendars). Don't broaden scope unless user asks "across all calendars" or results are clearly wrong.

### Agenda (today-only by default)
- If user asks "agenda" without a period, return today only.
Confidence
75% confidence
Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.