skills/clawlink-hq/skills/cal/Gen Agent Trust Hub

cal

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx to execute the @useclawlink/cli package from the npm registry. This is a standard method for utilizing the vendor's official command-line interface tools.
  • [COMMAND_EXECUTION]: The skill instructs the agent to interact with Cal.com via shell commands using the ClawLink CLI. This is the intended and primary mechanism for the skill's functionality.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external Cal.com events and attendees. While this presents a surface for indirect injection, the skill specifically instructs the agent to read data first and seek user confirmation before performing any write operations, which aligns with security best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM