google-calendar

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill uses npx @useclawlink/cli to download and execute the vendor's command-line interface tool during setup and operation.
  • [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands using the npx @useclawlink/cli utility to interact with the Google Calendar API.
  • [INDIRECT_PROMPT_INJECTION]: The skill represents an attack surface for indirect prompt injection by ingesting untrusted data from external sources.
  • Ingestion points: External data is ingested via googlecalendar_events_list, googlecalendar_events_get, and googlecalendar_find_event actions.
  • Boundary markers: No specific delimiters or instructions to ignore embedded commands are provided in the documentation.
  • Capability inventory: The skill allows for shell command execution and interaction with Google Calendar resources.
  • Sanitization: There is no explicit mention of sanitization or validation of the content retrieved from calendar events before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 05:45 PM