caldav-calendar
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
vdirsyncerandkhalcommand-line tools to interact with calendar data. These are standard Linux utilities for CalDAV synchronization and management. - [SAFE]: The skill does not include any hardcoded credentials. It correctly advises the user to store passwords in separate local files (e.g.,
~/.config/vdirsyncer/icloud_password) and fetch them using thecatcommand within the configuration. - [SAFE]: No obfuscation, prompt injection, or suspicious network activities to unknown domains were detected. The skill interacts with legitimate service providers like iCloud, Google, and Nextcloud as configured by the user.
- [SAFE]: While the skill ingests untrusted data from external calendar servers, this is its primary intended purpose.
- Ingestion points: Remote CalDAV servers specified in the user's configuration file (
SKILL.md). - Boundary markers: None defined.
- Capability inventory: Local execution of
vdirsyncerandkhal(including search and edit functions). - Sanitization: Not explicitly specified in the instructions; the skill relies on the underlying CLI tools for data handling.
Audit Metadata