The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The uv.lock and pyproject.toml files specify package versions that significantly exceed current public releases (e.g., icalendar==7.1.0, ruff==0.15.12, pytest==9.0.3, and six==1.17.0). These 'future' versions do not exist on the public PyPI registry at this time. The lock file also includes librt 0.10.0 as a dependency of mypy, which is not a standard dependency for that package. This pattern is strongly indicative of dependency confusion or supply chain targeting.
[COMMAND_EXECUTION]: The scripts/check_dependencies.py script facilitates the execution of uv sync. This command installs the packages defined in the suspicious uv.lock file. If these non-existent versions were registered on a registry by an attacker, it would result in arbitrary code execution during the environment setup process.
[DATA_EXFILTRATION]: In scripts/ics_manager.py, the skill uses urllib.request.urlopen to fetch ICS files from arbitrary URLs provided via the ICS_SOURCE variable or CLI flags. The implementation lacks URL validation or domain whitelisting, making it vulnerable to Server-Side Request Forgery (SSRF). This could allow an attacker to use the agent to probe internal network metadata or services.
[PROMPT_INJECTION]: The skill ingests untrusted data from external ICS sources through urlopen and processes it into the agent's context via the list-events and overview commands. This creates a surface for Indirect Prompt Injection. Maliciously crafted calendar events could contain hidden instructions in fields like 'Summary' or 'Description' intended to manipulate the agent's subsequent behavior.
Ingestion points: scripts/ics_manager.py (via urlopen and Calendar.from_ical)
Boundary markers: Absent from the instructions when interpolating event data into the prompt.
Capability inventory: Subprocess execution (uv sync), network requests (urlopen), and local file writes (write_calendar).
Sanitization: None; the script prints raw strings from the ICS components.

ics-manager