Calendar Planner
Pass
Audited by Gen Agent Trust Hub on Apr 20, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates using established command-line tools (gcalcli, khal, vdirsyncer) and localized Python scripts to audit and merge calendar data. All external communications are directed toward well-known, trusted providers (Google, Microsoft, and user-configured CalDAV servers).
- [COMMAND_EXECUTION]: The skill provides recipes for executing calendar actions via terminal. However, it explicitly instructs the agent to show the command, explain side effects, and obtain user approval before any write operations. The use of
osascriptfor macOS Calendar automation is standard and documented. - [DATA_EXFILTRATION]: No evidence of unauthorized data exfiltration. The skill is designed to process calendar metadata and explicitly limits external data transmission to the specific calendar providers selected by the user. It warns users that metadata is sent to these services.
- [CREDENTIALS_UNSAFE]: The skill does not contain hardcoded secrets. It utilizes environment variables (e.g.,
$GOOGLE_CLIENT_ID) and standard OAuth/delegated scope workflows for authentication. - [REMOTE_CODE_EXECUTION]: The skill does not download or execute remote scripts. All logic is contained within the provided local Python files (
calendar_merge.py,calendar_guard.py,week_plan.py) which perform basic data processing and reporting tasks.
Audit Metadata