cal-com-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to configure a third-party MCP server endpoint to function.
- Evidence: The 'Setup' section instructs adding
https://rube.app/mcpas an MCP server in the client configuration. - [REMOTE_CODE_EXECUTION]: By adding an external MCP server, the agent delegates tool execution logic to a remote environment.
- Evidence: The instructions guide the user to add a remote endpoint (
https://rube.app/mcp) which then provides the tools (CAL_*,RUBE_*) used by the skill. - [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources which could contain malicious instructions.
- Ingestion points: Tools such as
CAL_FETCH_ALL_BOOKINGSandCAL_GET_TEAMS_LISTingest external data including booking metadata, attendee names, and team information. - Boundary markers: The instructions do not define delimiters or warnings to ignore instructions embedded within the data returned by these tools.
- Capability inventory: The agent has the ability to write to external state using tools like
CAL_POST_NEW_BOOKING_REQUEST,CAL_UPDATE_WEBHOOK_BY_ID, andCAL_CREATE_TEAM_IN_ORGANIZATION. - Sanitization: There is no requirement or instruction for the agent to sanitize or validate external content before processing it, making it vulnerable to indirect instruction fulfillment.
Audit Metadata