calendar

SUSPICIOUS: the skill's calendar capabilities are well aligned with its stated purpose, and its data flows appear intended for legitimate Lark calendar operations. The main issue is install/execution trust: it depends on an ambiguously sourced `lark` binary whose evidenced command set matches a personal GitHub CLI that handles real auth tokens and private calendar data, creating a high supply-chain and credential-forwarding risk even without direct evidence of malicious behavior.