calctl
Pass
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing local shell commands (
calctl) which interface withicalBuddyand AppleScript to manage the user's local Apple Calendar. This is the intended primary functionality of the skill. - [EXTERNAL_DOWNLOADS]: The documentation specifies a requirement for
ical-buddy, suggesting installation viabrew install. Homebrew is a well-known and trusted package management service. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection as it reads data (event titles, notes) from external sources (the local calendar) which may contain untrusted data.
- Ingestion points: Events retrieved via
calctl showandcalctl search(SKILL.md). - Boundary markers: None identified in the provided documentation.
- Capability inventory: Execution of local CLI tools (
calctl) and AppleScript. - Sanitization: No explicit sanitization or filtering of calendar content is mentioned.
Audit Metadata