The Agent Skills Directory

[DATA_EXFILTRATION]: The skill reads the local macOS calendar database located at ~/Library/Group Containers/group.com.apple.calendar/Calendar.sqlitedb. This file contains sensitive personal information, including event summaries, locations, descriptions, and attendee email addresses. While this access is necessary for the skill's core functionality, it exposes private user data to the agent's context.\n- [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests and processes untrusted data from external sources (calendar events which could be sent by third parties).\n
Ingestion points: Event summaries and descriptions are read from the SQLite database in get_by_uid.sh, list_today.sh, list_upcoming.sh, and search_events.sh.\n
Boundary markers: The scripts do not use clear delimiters or instructions to the agent to ignore potential commands embedded within the event data.\n
Capability inventory: The skill has the ability to modify the user's system state by creating or deleting calendar events using create_event.sh and delete_event.sh.\n
Sanitization: Although event descriptions are truncated to 500 characters, there is no validation or sanitization to prevent natural language instructions from influencing the agent.\n- [COMMAND_EXECUTION]: The skill executes shell commands such as sqlite3 and osascript using arguments provided by the agent. Input variables (like UIDs and calendar names) are escaped using basic shell pattern substitution to mitigate SQL injection risks, and destructive operations require a --confirm flag as a safeguard.

calendar