caldav-calendar

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the vdirsyncer and khal command-line tools to interact with calendar data. These are standard Linux utilities for CalDAV synchronization and management.
  • [SAFE]: The skill does not include any hardcoded credentials. It correctly advises the user to store passwords in separate local files (e.g., ~/.config/vdirsyncer/icloud_password) and fetch them using the cat command within the configuration.
  • [SAFE]: No obfuscation, prompt injection, or suspicious network activities to unknown domains were detected. The skill interacts with legitimate service providers like iCloud, Google, and Nextcloud as configured by the user.
  • [SAFE]: While the skill ingests untrusted data from external calendar servers, this is its primary intended purpose.
  • Ingestion points: Remote CalDAV servers specified in the user's configuration file (SKILL.md).
  • Boundary markers: None defined.
  • Capability inventory: Local execution of vdirsyncer and khal (including search and edit functions).
  • Sanitization: Not explicitly specified in the instructions; the skill relies on the underlying CLI tools for data handling.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 01:02 AM
Security Audit — agent-trust-hub — caldav-calendar