Trust Assessment
gcalcli received a trust score of 88/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 0 high, 2 medium, and 0 low severity. Key findings include Unpinned Git Branch for gcalcli Dependency, Unspecified Local Dependency 'gcmd'.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| MEDIUM | Unpinned Git Branch for gcalcli Dependency The skill explicitly recommends installing `gcalcli` from a specific Git branch (`attachments-in-tsv-and-json`) of a forked repository (`shanemcd/gcalcli`). Using a branch instead of a specific commit hash means that the underlying code can change at any time without explicit updates to the skill, introducing a potential supply chain vulnerability. A malicious actor gaining control of the `shanemcd/gcalcli` repository or that specific branch could inject arbitrary code. Pin the `gcalcli` dependency to a specific, immutable commit hash (e.g., `git+https://github.com/shanemcd/gcalcli@<commit_hash>`) instead of a branch name. Regularly review the upstream repository for changes. | LLM | SKILL.md:10 | |
| MEDIUM | Unspecified Local Dependency 'gcmd' The skill describes using a tool named `gcmd` via `uv run gcmd export` and explicitly changes directory to a local path `/var/home/shanemcd/github/shanemcd/gcmd`. The source, installation, and trustworthiness of this `gcmd` tool are not specified within the skill. Relying on an unmanaged local tool introduces a hidden dependency and supply chain risk, as its origin and integrity are unknown. If `gcmd` is compromised or malicious, it could lead to further security issues. Provide clear instructions for installing `gcmd` from a trusted, pinned source (e.g., a specific Git repository and commit hash, or a package manager). Alternatively, if `gcmd` is part of the skill package, ensure it is properly vetted and included. | LLM | SKILL.md:136 |
Scan History
Embed Code
[](https://skillshield.io/report/b3bf40c129ffbda3)
Powered by SkillShield