中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:20 hr ago Rescan
5 /100
calendar-crab
Google Calendar CLI — list, create, move, and delete events
Clean Google Calendar CLI with legitimate OAuth implementation, no malicious behavior detected.
Skill Namecalendar-crab
Duration26.8s
Enginepi
✓
Safe to install
This skill is safe to use. No security concerns identified.

Findings 1 items

Severity Finding Location
Low
Token file write not explicitly declared Doc Mismatch
SKILL.md states the script 'auto-refreshes the access token' but does not explicitly state it writes the updated token back to disk. The write is a necessary part of OAuth token refresh.
fs.writeFileSync(TOKEN_FILE, JSON.stringify(newTokens, null, 2));
→ Add to SKILL.md: 'Access tokens are automatically refreshed and persisted to disk.'
 calendar-crab.js:74
ResourceDeclaredInferredStatusEvidence
Filesystem READ READ+WRITE ✓ Aligned Reads/writes to ~/.openclaw/secrets for OAuth tokens - necessary for OAuth flow
Network READ READ ✓ Aligned HTTPS requests only to oauth2.googleapis.com and www.googleapis.com (Google APIs…
Shell NONE NONE — No subprocess, exec, or shell execution detected
Environment READ READ ✓ Aligned Reads CALENDAR_CRAB_SECRETS, CALENDAR_CRAB_TZ, CALENDAR_CRAB_CALENDAR - all decl…
5 findings
🔗
Medium External URL 外部 URL
https://console.cloud.google.com/
README.md:33
📧
Info Email 邮箱地址
[email protected]
SKILL.md:31
📧
Info Email 邮箱地址
[email protected]
SKILL.md:31
📧
Info Email 邮箱地址
[email protected]
calendar-crab.js:176
📧
Info Email 邮箱地址
[email protected]
calendar-crab.js:176

File Tree

3 files · 15.2 KB · 506 lines
JavaScript 1f · 331L Markdown 2f · 175L
├─ 📜 calendar-crab.js JavaScript 331L · 10.5 KB
├─ 📝 README.md Markdown 87L · 2.3 KB
└─ 📝 SKILL.md Markdown 88L · 2.4 KB

Security Positives

✓ Zero external dependencies - no supply chain risk
✓ Native Node.js https.request used for API calls - no curl/wget
✓ Network requests limited to legitimate Google APIs (oauth2.googleapis.com, www.googleapis.com)
✓ No shell execution, subprocess, or eval() calls
✓ No credential harvesting or exfiltration
✓ No obfuscation or hidden functionality
✓ OAuth implementation follows standard Google OAuth2 flow
✓ Access tokens stored locally in user's secrets directory (~/.openclaw/secrets)