wecomcli-calendar

Pass

Audited by Gen Agent Trust Hub on Aug 18, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill utilizes a platform-provided tool called wecom-cli and explicitly prohibits the use of shell commands or terminal execution (exec, shell), ensuring operations are performed within a controlled tool environment.
  • [SAFE]: There are strict data handling rules that prevent the exposure of sensitive internal identifiers. The skill mandates that userid strings (e.g., those with wo prefixes) must never be shown to the user, requiring the agent to use display names instead.
  • [SAFE]: The skill includes robust logic for intent disambiguation, particularly for distinguishing between simple schedules and online meetings, which prevents unintended actions and ensures the correct sub-skill is invoked.
  • [SAFE]: All write operations, such as creating or updating schedules, follow a structured workflow that includes mandatory parameter validation and conflict checking (via the freebusy reference) before execution.
  • [SAFE]: The skill incorporates a security pre-flight check (wecomcli-preflight) as a prerequisite for tool usage, demonstrating a layered security approach to tool whitelisting.
  • [SAFE]: No evidence of prompt injection, obfuscation, unauthorized network access, or persistence mechanisms was found in the instructions or references.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 18, 2026, 10:33 AM
Security Audit — agent-trust-hub — wecomcli-calendar