cal
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute the@useclawlink/clipackage from the npm registry. This is a standard method for utilizing the vendor's official command-line interface tools. - [COMMAND_EXECUTION]: The skill instructs the agent to interact with Cal.com via shell commands using the ClawLink CLI. This is the intended and primary mechanism for the skill's functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Cal.com events and attendees. While this presents a surface for indirect injection, the skill specifically instructs the agent to read data first and seek user confirmation before performing any write operations, which aligns with security best practices.
Audit Metadata