google-calendar
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npx @useclawlink/clito download and execute the vendor's command-line interface tool during setup and operation. - [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the
npx @useclawlink/cliutility to interact with the Google Calendar API. - [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection by ingesting untrusted data from external sources.
- Ingestion points: External data is ingested via
googlecalendar_events_list,googlecalendar_events_get, andgooglecalendar_find_eventactions. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided in the documentation.
- Capability inventory: The skill allows for shell command execution and interaction with Google Calendar resources.
- Sanitization: There is no explicit mention of sanitization or validation of the content retrieved from calendar events before it is processed by the agent.
Audit Metadata