Security audit

Google 日历专业版

Security checks across malware telemetry and agentic risk

Overview

The skill is a calendar-management helper, but it asks for broad agent routing and exec-style capabilities beyond clearly scoped calendar use.

Install only if you want an agent to manage calendar data through local commands and external calendar services. Before use, narrow activation to calendar tasks, require confirmation for creates, deletes, batch changes, exports, and attendee notifications, and only configure trusted HTTPS webhook destinations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is presented as a Google Calendar management tool, but it later advertises broad file-processing behavior unrelated to calendar operations. This scope expansion weakens the principle of least privilege and can cause an agent or user to invoke the skill for unintended tasks, increasing the chance of unauthorized data access or misuse.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documentation broadens from calendar management into generic command execution and information retrieval, which materially changes the trust boundary of the skill. In an agent environment, this can lead to the skill being selected for unrelated tasks and used as a general-purpose execution surface with access beyond calendar data.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: Listing generic system command execution as a core capability without clear calendar-specific limits creates a direct path to abuse if an agent maps user input into shell commands. Because the skill declares exec access, this ambiguity can result in arbitrary local command execution under the guise of calendar operations.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill claims commands should be whitelisted, but elsewhere it promotes unrestricted exec-style behavior as a core function. This inconsistency is dangerous because reviewers and agents cannot rely on the stated safety guidance when the rest of the document encourages broader execution semantics.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation guidance is so broad that it could match many unrelated AI, orchestration, or LLM-use requests rather than only calendar tasks. Overbroad routing increases the likelihood that the agent invokes this skill in inappropriate contexts, exposing exec-capable tooling and external integrations when they are not needed.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill documents create, export, batch operations, and attendee notifications without clear warnings that these actions can modify data or send communications. In an agent setting, insufficient disclosure around state-changing behavior raises the risk of unintended event creation, mass changes, or accidental attendee notifications.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The documented callback_url/webhook behavior can transmit calendar results to an external endpoint, but the skill does not clearly warn about privacy, data sensitivity, or trust requirements for the destination. This can lead to unintentional exfiltration of event metadata, attendee information, or scheduling details to third parties.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.