The Agent Skills Directory

[SAFE]: The skill's behavior is entirely consistent with its stated purpose of calendar management and scheduling. No malicious patterns or security risks were identified after a comprehensive review of the code and instructions.
[EXTERNAL_DOWNLOADS]: Dependencies listed in requirements.txt (chinese-calendar and zhdate) are well-known, legitimate Python packages for Chinese calendar functionality and are sourced from official registries.
[COMMAND_EXECUTION]: Local command execution is confined to running the skill's own CLI script (calendar_cli.py) for calendar queries and event management. No evidence of unsafe command construction or remote code injection was found.
[DATA_EXFILTRATION]: The skill does not request network access and has no code for external data transmission. Event data is stored locally in data/events.json using atomic file replacement to ensure data safety.
[PROMPT_INJECTION]: The skill processes user-supplied event titles that are later displayed in scheduled reminders. This creates an indirect prompt injection surface, but it is considered a standard feature of the scheduling application with no immediate security impact.
Ingestion points: Event titles ingested via scripts/events.py from CLI arguments.
Boundary markers: None present in output strings.
Capability inventory: Limited to local file system persistence for event data and terminal output.
Sanitization: Basic string handling is applied for display purposes without advanced filtering.

chinese-calendar