Skip to content
skillsafebeta
← Report library
Purpose / Other

Gws Calendar Skill Security Audit

What the author says it does (original text)

Google Calendar: Manage calendars and events.

Independent security check

Do not install or run it yet

Files checked
1
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.Risks found: 1
High risk

The Skill exposes operations that can permanently clear calendars or delete calendars and events

Source references: 3
What we found

The catalog explicitly offers methods to remove every event from a primary calendar, delete a secondary calendar, and delete individual events. The visible rules require schema inspection but no per-action confirmation, backup, or target restriction.

Why this matters

A mistaken account, calendar ID, or event ID could remove the user’s schedule and affect invitees. Clearing a primary calendar deletes all of its events in one operation.

This is a catalog of callable methods, not an instruction to delete automatically. It nevertheless exposes operations that clear every event from a primary calendar, delete a secondary calendar, or delete one event. Calling them without an explicitly identified target and confirmation could cause irreversible data loss. The visible file only requires parameter inspection, with no backup or per-action confirmation rule. A user can restrict use to read-only methods and require separate confirmation showing the account, calendar, and event before any `clear` or `delete` call.

SKILL.md:53In the instructionsOpen original file
  - `clear` — Clears a primary calendar. This operation deletes all events associated with the primary calendar of an account.  - `delete` — Deletes a secondary calendar. Use calendars.clear for clearing all events on primary calendars.  - `get` — Returns metadata for a calendar.
Show 2 other places
SKILL.md:73In the instructionsOpen original file
  - `delete` — Deletes an event.  - `get` — Returns an event based on its Google Calendar ID. To retrieve an event using its iCalendar ID, call the events.list method using the iCalUID parameter.
SKILL.md:98In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws calendar --help# Inspect a method's required params, types, and defaultsgws schema calendar.<resource>.<method>```
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.Risks found: 1
High risk

It can alter or remove calendar access rules and mentions domain-wide user impersonation

Source references: 3
What we found

The Skill exposes ACL creation, update, and deletion methods, and also suggests domain-wide delegation for acting on behalf of specific users. These capabilities can change who may access calendars or broaden the accounts an application can represent.

Why this matters

With incorrect parameters or overly broad credentials, a third party could gain calendar access or a legitimate user could lose it. Domain-wide delegation may let the application act as organizational users rather than affecting only the current account.

The catalog does expose ACL creation, update, and deletion; if invoked for the wrong calendar or principal, these operations could grant, alter, or remove access. Domain-wide delegation appears as ownership guidance for calendar creation, not as an instruction for the Skill to configure that privilege, but it explicitly describes a high-privilege mode in which an application acts for a user. A user can authorize only necessary accounts and calendars, require every ACL write to show the principal, role, and target, and subject domain-wide delegation to separate administrator approval.

SKILL.md:33In the instructionsOpen original file
  - `delete` — Deletes an access control rule.  - `get` — Returns an access control rule.  - `insert` — Creates an access control rule.  - `list` — Returns the rules in the access control list for the calendar.  - `patch` — Updates an access control rule. This method supports patch semantics.  - `update` — Updates an access control rule.  - `watch` — Watch for changes to ACL resources.
Show 2 other places
SKILL.md:59In the instructionsOpen original file
Note: We recommend to authenticate as the intended data owner of the calendar. You can use domain-wide delegation of authority to allow applications to act on behalf of a specific user. Don't use a service account for authentication. If you use a service account for authentication, the service account is the data owner, which can lead to unexpected behavior.  - `patch` — Updates metadata for a calendar. This method supports patch semantics.
SKILL.md:56In the instructionsOpen original file
  - `get` — Returns metadata for a calendar.  - `insert` — Creates a secondary calendar.The authenticated user for the request is made the data owner of the new calendar.Note: We recommend to authenticate as the intended data owner of the calendar. You can use domain-wide delegation of authority to allow applications to act on behalf of a specific user. Don't use a service account for authentication. If you use a service account for authentication, the service account is the data owner, which can lead to unexpected behavior.  - `patch` — Updates metadata for a calendar. This method supports patch semantics.
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.Risks found: 1
Medium risk

A missing prerequisite causes new external instructions to be generated and trusted

Source references: 1
What we found

The Skill requires an out-of-package `../gws-shared/SKILL.md` and directs the agent to generate it when absent. That generated content is not included here, so users cannot pre-review the instructions governing authentication, global flags, and security rules.

Why this matters

If the `gws` binary or its generation template is untrusted, later agent behavior could be influenced by substituted authentication or security instructions. The generation command also creates persistent local files. The evidence does not show that such tampering has occurred.

What this evidence establishes

If the shared file is absent, the prerequisite does direct the agent to generate it and then rely on it for authentication and security rules; that generated content is not available for review here. However, this appears to be an initialization step of the same `gws` tool, and the evidence does not show an untrusted download or automatic execution of actions described by the generated file. A user can require the generated file and its provenance to be reviewed before authorizing use.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:16In the instructionsOpen original file
> **PREREQUISITE:** Read `../gws-shared/SKILL.md` for auth, global flags, and security rules. If missing, run `gws generate-skills` to create it.
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Moving an event also changes its organizer

Source references: 2
What we found

`events.move` is not merely calendar organization: its description explicitly says moving an event to another calendar changes the organizer. The visible file does not require confirmation before this identity change.

Why this matters

An unintended move may change who controls meeting updates, invitations, and later administration, confusing attendees or assigning a business engagement to the wrong organizer.

The description explicitly says `events.move` transfers an event to another calendar and changes its organizer, so it can alter control of a meeting rather than merely reorganize it. The risk arises only if this method is called and applies only to the listed default event type; no organizer-change confirmation requirement is visible. A user can require the source calendar, destination calendar, event, and resulting organizer to be shown and separately confirmed first.

SKILL.md:80In the instructionsOpen original file
  - `list` — Returns events on the specified calendar.  - `move` — Moves an event to another calendar, i.e. changes an event's organizer. Note that only default events can be moved; birthday, focusTime, fromGmail, outOfOffice and workingLocation events cannot be moved.  - `patch` — Updates an event. This method supports patch semantics.
Show 1 other places
SKILL.md:98In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws calendar --help# Inspect a method's required params, types, and defaultsgws schema calendar.<resource>.<method>```

Inside this skill

3 instruction sections

This Skill is a Google Calendar command catalog. It tells the agent to inspect each method’s parameter schema before constructing parameters and JSON; the shown file contains no script that automatically invokes those methods.

View source
SKILL.md:98In the instructionsOpen original file
Before calling any API method, inspect it:```bash# Browse resources and methodsgws calendar --help# Inspect a method's required params, types, and defaultsgws schema calendar.<resource>.<method>```
SKILL.md:108In the instructionsOpen original file
Use `gws schema` output to build your `--params` and `--json` flags.

Commands operate as the currently authenticated Google identity. A new calendar’s data owner depends on that identity, and service-account authentication may produce unexpected ownership results.

View source
SKILL.md:57In the instructionsOpen original file
  - `insert` — Creates a secondary calendar.The authenticated user for the request is made the data owner of the new calendar.Note: We recommend to authenticate as the intended data owner of the calendar. You can use domain-wide delegation of authority to allow applications to act on behalf of a specific user. Don't use a service account for authentication. If you use a service account for authentication, the service account is the data owner, which can lead to unexpected behavior.  - `patch` — Updates metadata for a calendar. This method supports patch semantics.
Start here · InstructionsSKILL.md
gws-calendar
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:18In the instructionsOpen original file
```bashgws calendar <resource> <method> [flags]
SKILL.md:100In the instructionsOpen original file
```bash# Browse resources and methods
Lines read
110
File checksum (to compare versions)
1b189227fdce517f8f38591a5be693b95ccaad40456afdc7698f225b3b250f56