Security audit

gcal-pro - Google Calendar

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real Google Calendar skill, but it can create, update, or delete calendar events without reliably enforcing user confirmation.

Install only if you are comfortable granting Google Calendar access. Prefer read-only use unless you need Pro writes, protect ~/.config/gcal-pro, do not share or display credential files, and require an explicit preview plus confirmation before any create, quick-add, update, or delete action. Enable cron or messaging briefs only for private destinations you trust.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs use of shell commands, local file access to OAuth secrets and tokens, and networked Google Calendar operations, but it does not declare any permissions or boundaries. In an agent environment, this mismatch can cause overly broad implicit access and reduces transparency for review, increasing the risk of unauthorized file, network, or command execution.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The troubleshooting guidance tells users to bypass Google's "unsafe" warning by clicking through to an unverified app without any safety disclaimer or verification steps. This normalizes ignoring browser and OAuth trust warnings, which can train users to override legitimate security protections and expose their Google account data to an unreviewed application.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The skill description says to use it for broad calendar-related requests like checking schedules, adding, editing, deleting, and morning briefs, without clear activation constraints. Overbroad triggers can cause the wrong skill to activate on ambiguous user input, leading to unintended access to sensitive calendar data or accidental calendar modifications.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The create-event guidance activates on vague phrases like 'Add X to my calendar' or 'Schedule Y' without constraints for ambiguity, identity, date resolution, or conflict handling. In a natural-language agent, this increases the chance of unintended event creation from loosely related conversation or incomplete instructions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill recommends sending morning briefs containing calendar contents to messaging channels, which are external destinations, without explicit consent, destination validation, or privacy warnings. Calendar entries often contain sensitive personal, business, location, and meeting information, so automated forwarding can create a confidentiality breach.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The guide explicitly tells users to bypass Google's unverified-app warning by clicking through an 'unsafe' prompt, without explaining the security implications or limiting this to controlled developer testing. This normalizes overriding a security warning and could train users to authorize unverified OAuth apps that may request sensitive calendar access.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module hard-codes DEFAULT_TIMEZONE to America/New_York and applies it when parsing and formatting dates. In a calendar skill, this can cause events to be read, displayed, or created at the wrong local time for users in other regions, leading to missed meetings or unintended scheduling changes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: quick_add performs an immediate write operation against Google Calendar using natural-language text and does not present a pre-action confirmation step. Because natural-language parsing can be ambiguous, this increases the risk of unintended event creation, attendee notifications, and calendar modification from misunderstood user input or prompt injection flowing into the tool call.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: location: Event location attendees: List of attendee emails calendar_id: Target calendar confirmed: Skip confirmation if True Returns: Created event or None
Confidence: 93% confidence
Finding: create_event accepts confirmed=False by default but allows callers to set confirmed=True and bypass the interactive confirmation entirely. In an agent setting, this enables autonomous calendar writes if upstream logic or prompt-influenced orchestration marks the action as confirmed without an actual user approval checkpoint.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: description: New description (optional) location: New location (optional) calendar_id: Calendar ID confirmed: Skip confirmation if True Returns: Updated event or None
Confidence: 94% confidence
Finding: update_event allows confirmed=True to skip confirmation before modifying an existing calendar event. In context, this is more dangerous than a read-only error because an agent could silently alter time, location, or description of real appointments, causing operational disruption and misleading attendees.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: Args: event_id: ID of event to delete calendar_id: Calendar ID confirmed: Skip confirmation if True Returns: True if deleted successfully
Confidence: 98% confidence
Finding: delete_event permits confirmed=True to bypass the warning for a destructive action. In a calendar-management skill, silent deletion is especially risky because it can remove important records and meetings without an undo path, and may be triggered by faulty orchestration or adversarial prompt influence.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: ]) parser.add_argument("--query", "-q", help="Search query or event text") parser.add_argument("--id", help="Event ID for delete/update") parser.add_argument("--yes", "-y", action="store_true", help="Skip confirmation") args = parser.parse_args()
Confidence: 90% confidence
Finding: The CLI exposes a --yes flag that skips confirmation for destructive or state-changing operations. While framed for testing, this creates an easy pathway for automation to perform write actions without human review, which is risky if the script is reused in production workflows or invoked by other tooling.

Credential Access

High

Category: Privilege Escalation
Content: # Configuration CONFIG_DIR = Path.home() / ".config" / "gcal-pro" CLIENT_SECRET_FILE = CONFIG_DIR / "client_secret.json" TOKEN_FILE = CONFIG_DIR / "token.json" LICENSE_FILE = CONFIG_DIR / "license.json"
Confidence: 86% confidence
Finding: The module stores sensitive OAuth material in predictable local files under ~/.config/gcal-pro, including token.json and client_secret.json. While local storage is necessary for this type of integration, the code only applies restrictive permissions to token.json after writing and does not harden the directory or other sensitive files, increasing the risk of credential exposure on multi-user or misconfigured systems.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # gcal-pro dependencies google-auth>=2.23.0 google-auth-oauthlib>=1.1.0 google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0
Confidence: 92% confidence
Finding: The dependency is specified with only a minimum version, which allows future unreviewed releases to be installed. That creates supply-chain and reproducibility risk: a compromised, incompatible, or vulnerable upstream release could be pulled into builds without deliberate validation. In a calendar integration that likely handles OAuth tokens and user scheduling data, dependency trust matters, though this file alone does not show active exploitation.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # gcal-pro dependencies google-auth>=2.23.0 google-auth-oauthlib>=1.1.0 google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0 pytz>=2023.3
Confidence: 92% confidence
Finding: Using an open-ended version range for google-auth-oauthlib permits installation of newer releases that have not been security-reviewed in this project. This weakens build reproducibility and increases exposure to upstream supply-chain compromise or accidental introduction of security bugs in authentication-related code.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # gcal-pro dependencies google-auth>=2.23.0 google-auth-oauthlib>=1.1.0 google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0 pytz>=2023.3 python-dateutil>=2.8.2
Confidence: 91% confidence
Finding: The package constraint allows any version at or above the minimum, so installations may vary over time and across environments. That makes the build non-deterministic and can introduce vulnerable or malicious upstream code unexpectedly, which is relevant for a skill integrating with Google APIs and potentially processing credentials.

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth>=2.23.0 google-auth-oauthlib>=1.1.0 google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0 pytz>=2023.3 python-dateutil>=2.8.2
Confidence: 93% confidence
Finding: The google-api-python-client dependency is not pinned to a specific tested version, allowing future releases to be resolved automatically. This can introduce unexpected behavior, newly disclosed vulnerabilities, or malicious supply-chain changes, especially significant for a tool that can read and potentially modify calendar data.

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth-oauthlib>=1.1.0 google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0 pytz>=2023.3 python-dateutil>=2.8.2
Confidence: 89% confidence
Finding: Although pytz is a common utility library, specifying only a lower bound still permits uncontrolled upgrades. The main risk is supply-chain and reliability related rather than direct code-level exploitation from this line alone, so the danger is real but limited in severity.

Unpinned Dependencies

Low

Category: Supply Chain
Content: google-auth-httplib2>=0.1.1 google-api-python-client>=2.100.0 pytz>=2023.3 python-dateutil>=2.8.2
Confidence: 89% confidence
Finding: python-dateutil is also unpinned, which leaves the environment vulnerable to non-deterministic dependency resolution and potential upstream compromise. While this is not evidence of malicious behavior by the skill author, it is a genuine supply-chain hardening gap.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.