odyssey4me/google-calendar
Create, update, and organize Google Calendar events and schedules. Check availability, book time, and manage calendars. Use when asked to schedule a meeting, set up an appointment, book a call, check gcal, or manage calendar events.
71
89%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
1 high severity finding. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The prompt includes examples that store client_id/client_secret in plaintext YAML and explicitly uses command-line flags like `--client-id ID --client-secret SECRET`, which require the agent to emit secret values verbatim in commands or config — an exfiltration risk.
Where we found it
--client-id ID --client-secret SECRET
command · 5 sites
The plugin documents and implements an `auth setup` command that requires the agent to pass OAuth client_id and client_secret as command-line arguments, which causes the agent to emit secret values verbatim in the command line.
SKILL.md
64
$SKILL_DIR/scripts/google-calendar.py auth setup --client-id ID --client-secret SECRET
scripts/google-calendar.py
8
python google-calendar.py auth setup --client-id ID --client-secret SECRET
239
f" 1. Service config: Run python google-calendar.py auth setup --client-id YOUR_ID --client-secret YOUR_SECRET\n"
references/command-reference.md
23
--client-id YOUR_CLIENT_ID \
24
--client-secret YOUR_CLIENT_SECRET
[REDACTED]
secret · 4 sites
The plugin documentation shows a YAML config file example that stores OAuth client_id and client_secret in plaintext, which the agent would write to disk with real credential values.
SKILL.md
49
client_id: your-client-id.apps.googleusercontent.com
50
client_secret: your-client-secret
scripts/google-calendar.py
886
print(" client_id: YOUR_CLIENT_ID.apps.googleusercontent.com")
887
print(" client_secret: YOUR_CLIENT_SECRET")
- Audited
- Security analysis