wecomcli-calendar
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes a platform-provided tool called
wecom-cliand explicitly prohibits the use of shell commands or terminal execution (exec,shell), ensuring operations are performed within a controlled tool environment. - [SAFE]: There are strict data handling rules that prevent the exposure of sensitive internal identifiers. The skill mandates that
useridstrings (e.g., those withwoprefixes) must never be shown to the user, requiring the agent to use display names instead. - [SAFE]: The skill includes robust logic for intent disambiguation, particularly for distinguishing between simple schedules and online meetings, which prevents unintended actions and ensures the correct sub-skill is invoked.
- [SAFE]: All write operations, such as creating or updating schedules, follow a structured workflow that includes mandatory parameter validation and conflict checking (via the
freebusyreference) before execution. - [SAFE]: The skill incorporates a security pre-flight check (
wecomcli-preflight) as a prerequisite for tool usage, demonstrating a layered security approach to tool whitelisting. - [SAFE]: No evidence of prompt injection, obfuscation, unauthorized network access, or persistence mechanisms was found in the instructions or references.
Audit Metadata