events
Pass
Audited by Gen Agent Trust Hub on Mar 17, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill has a surface for indirect prompt injection. Ingestion points: Data from the Google Calendar API, including event summaries and descriptions, is processed in skill-router.json and passed to the agent. Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish untrusted calendar data from its core logic. Capability inventory: The skill allows for the reading, creation, and rescheduling of events but lacks any capability for shell execution or local file access. Sanitization: No filtering or sanitization of the retrieved calendar content is performed.
- [EXTERNAL_DOWNLOADS]: The skill connects to the well-known Google Calendar API (www.googleapis.com) to perform its functions. This is a trusted service appropriate for the skill's purpose.
Audit Metadata