Sync and query CalDAV calendars (iCloud, Google, Fastmail, Nextcloud, etc.) using vdirsyncer + khal. Works on Linux.
Security Analysis
high confidenceThe skill's instructions, files it touches, and optional install suggestion align with its stated purpose (syncing/querying CalDAV via vdirsyncer+khal); it does require access to local calendar/config files and credentials which is expected and should be handled carefully.
Name/description match the instructions: the SKILL.md tells the agent to use vdirsyncer and khal to sync and query CalDAV calendars. The referenced binaries, config paths (~/.config/vdirsyncer/, ~/.config/khal/), and data paths (~/.local/share/vdirsyncer/, ~/.local/share/khal/) are consistent with that purpose.
Instructions are focused on calendar sync/query workflows and explicitly tell the agent to run vdirsyncer/khal commands and to read/write configuration and local calendar files. This is necessary for functionality, but the skill does instruct access to sensitive local files (credential file example, config and cache removal). There is no instruction to read unrelated system files or to transmit data to unexpected external endpoints.
The skill is instruction-only (no install spec) which keeps risk low. The SKILL.md metadata includes an apt install suggestion for vdirsyncer and khal; this is a benign, expected package suggestion. There is no remote download or archive-extraction behavior.
The skill declares no required environment variables or credentials, which is consistent. However, the examples instruct storing/reading calendar passwords from a local file (password.fetch = ['command', 'cat', '~/.config/vdirsyncer/icloud_password']). That is appropriate for the task but is sensitive: it may expose credentials if the file is world-readable or if command invocation leaks arguments to process listings. Consider using secure storage (keyring, OS secret store, or appropriately permissioned files) instead of plaintext files.
The skill does not request always:true and does not modify other skills or global settings. It expects to read/write only its own config and data under the user's home (~/.config, ~/.local/share), which is standard for a calendar client.
Guidance
This skill appears to do exactly what it says: automate vdirsyncer and khal to sync/query CalDAV calendars. Before installing/using it, ensure you trust the agent to run shell commands and access files in your home directory. Pay attention to how you store calendar credentials — the example uses a local file read via `cat`, which can expose secrets if file permissions or process listings are not secure. Prefer OS keyring or properly permissioned files for passwords, and install vdirsyncer/khal from your distro's package manager (or their official sources) rather than an untrusted binary. If you need OAuth-based Google access, be prepared to follow the provider's OAuth setup steps (not fully covered in this guide).
Latest Release
v1.0.1
Added more instruction for how to update events
More by @Asleep123
Published by @Asleep123 on ClawHub
