Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-17
The package is a static description of a calendar-management skill and contains no executable code. The files describe creating events, scheduling meetings, setting reminders, viewing availability, recurring events, and syncing with Google, Apple, and Outlook calendars. The only external reference is a publisher link to clawhub.ai, and the files note that curl and jq may be required for calendar provider workflows, but no network calls, shell commands, credential access, file writes, payment behavior, persistence, or obfuscation are actually implemented. Nothing in the package attempts to hide data or override agent rules. The main review consideration is whether the user trusts the stated calendar-access purpose if a future implementation is supplied.
| Declared purpose | Calendar management and scheduling. Create events, manage meetings, and sync across calendar providers. |
| Observed behavior | The package contains only markdown and metadata files. SKILL.md documents the skill's stated features, supported providers, and usage examples. _meta.json provides ownership, version, and publish timestamp. skill-card.md is a marketplace listing with a publisher link, risk statement, output types, and ethical considerations. No code, commands, network requests, or file actions are present in the package files. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | The metadata declares a requirement for curl, and skill-card.md says curl may be needed for calendar provider workflows. The package itself contains no network code or hidden destinations. |
| shell | needed | SKILL.md lists curl and jq as required binaries, and skill-card.md lists 'Shell commands' as a possible output type. No shell command is present in the package files. |
| severity | finding |
|---|---|
| info | Declared purpose This is the package's stated purpose. The files match this description and do not document additional hidden behavior. SKILL.md:3 description: Calendar management and scheduling. Create events, manage meetings, and sync across calendar providers. |
| info | Declared binary requirements The skill metadata says it requires the curl and jq command-line tools, but the package provides no code that uses them. SKILL.md:4 metadata: {"clawdbot":{"emoji":"📅","requires":{"bins":["curl","jq"]}}} |
| info | Publisher link to clawhub.ai This is a static link to the package publisher. It does not create a network request by itself and is not a hidden destination. skill-card.md:9 [ndcccccc](https://clawhub.ai/user/ndcccccc) |
| info | Declared calendar data risk The publisher states that the skill may let an agent read or change calendar information if connected to providers. Users should review account access before use. skill-card.md:24 Risk: The skill may help an agent read or change calendar information when connected to calendar providers. |
| info | Shell commands listed as possible output type The listing says the skill may output shell commands, but the package files contain no shell commands or executable code. skill-card.md:34 **Output Type(s):** [Text, Markdown, Shell commands, Guidance] |
| info | curl and jq noted for provider workflows The listing says curl and jq may be required for calendar provider interactions. No such interaction is implemented in these files. skill-card.md:40 **Other Properties Related to Output:** [May require curl and jq when interacting with calendar provider workflows.] |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | curl |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 32 | 755ba50018ed8eee… |
_meta.json | 6 | 467d236add6dbeac… |
skill-card.md | 48 | 091bdc03bae40712… |
For agents
JSON: https://agenteconomy.report/k/calendar.audit.json · badge: https://agenteconomy.report/k/calendar.audited.svg ·
skill rating: /k/calendar · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).