← Back to Skills Marketplace
489
Downloads
1
Stars
0
Active Installs
3
Versions
Install in OpenClaw
/install opys-calendar
Description
A local markdown-backed calendar with CLI and optional two-way Google Calendar sync.
Usage Guidance
This package is internally consistent with its description, but review and handle sensitive artifacts carefully before installing or running it: 1) Protect Google OAuth credentials (GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET) and only set them if you intend to enable Google sync. 2) The app will persist session tokens and sync mappings to .calendar-sessions.json and .calendar-google-sync-state.json in the project root — these files contain tokens/IDs that should be kept private; consider adding them to .gitignore or removing any seed files shipped in the repo. 3) The agent snapshot (agent-snapshot.md by default) will contain recent and upcoming events and can be pointed to any path via CALENDAR_AGENT_SNAPSHOT — do not set this to a location where sensitive data should not be written. 4) The repo includes dev scripts (Playwright screenshots, etc.) and a full Node app; run npm install only from a trusted environment and inspect the code if you have strict security requirements. 5) If you don't need Google sync, leave OAuth env vars unset to avoid creating persisted tokens. If you want more assurance, ask the author for provenance (homepage/source URL verification) or run the code in an isolated environment first.
Capability Analysis
Type: OpenClaw Skill
Name: opys-calendar
Version: 0.1.2
The skill is classified as suspicious due to several security vulnerabilities and oversights. Most notably, the `.calendar-google-sync-state.json` and `.tmp-recent-calendar.md` files contain PII (an example email address) and local file paths, which are sensitive data leaks within the skill bundle itself. Additionally, the `CALENDAR_AGENT_SNAPSHOT` environment variable in `scripts/calendar-cli.ts` could potentially be exploited for arbitrary file writes if an attacker can control its value, posing a path traversal vulnerability. The `server/index.ts` also uses a permissive CORS configuration (`origin: true`), which could be a security risk in certain deployment scenarios.
Capability Assessment
Purpose & Capability
Name/description match the code and instructions: the repo provides a CLI, a React UI, an Express API server, and optional two-way Google Calendar sync. The environment variables and local files referenced (calendar.md, snapshot, sync state) are consistent with a local-first calendar with optional Google OAuth.
Instruction Scope
SKILL.md keeps scope focused on reading/writing calendar.md and using the CLI for mutating actions. It also instructs the agent to write a rolling snapshot (default ./agent-snapshot.md) and documents optional Google OAuth env vars. This is expected for an agent-first calendar, but the snapshot and session persistence are effectively data-export operations worth noticing.
Install Mechanism
No install spec is declared (instruction-only from platform perspective), but the package contains normal Node.js code and a package.json with common deps (express, dotenv, fullcalendar, etc.). There are no download-from-URL installs or unusual third-party installers in the repo metadata.
Credentials
Requested environment variables (Google OAuth client id/secret/redirect URI, APP_BASE_URL, PORT, and snapshot config) are proportional to optional Google sync and running the local server. They are optional in package.json. Be aware that supplying GOOGLE_CLIENT_SECRET enables the app to obtain OAuth tokens which the server persists locally.
Persistence & Privilege
The server and CLI persist multiple files to the project root: agent snapshots (agent-snapshot.md by default or as configured by CALENDAR_AGENT_SNAPSHOT), .calendar-google-sync-state.json, and a session store (.calendar-sessions.json). Persisting OAuth tokens and calendar snapshots on disk is expected for this functionality but increases local data exposure and requires filesystem protection.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install opys-calendar - After installation, invoke the skill by name or use
/opys-calendar - Provide required inputs per the skill's parameter spec and get structured output
Version History
v0.1.2
- Added an environment variable manifest and details to SKILL.md, clarifying supported env variables and their purposes.
- Changed the default agent snapshot file path from an absolute path to a relative one (`./agent-snapshot.md`) in documentation.
- Updated the skill name and description section with an explicit env manifest block.
- Improved documentation structure for clarity, especially regarding environment variable configuration.
v0.1.1
- Added scripts/check_error.js for error checking automation.
- Added scripts/take_screenshots.js to support automated screenshot capture.
- No changes to core calendar or sync functionality.
v0.1.0
Initial release of opys-calendar skill.
- Provides CLI commands to add, update, check, delete events, and manage categories in a markdown-backed calendar.
- Synchronizes events with Google Calendar via UI-based sync controls.
- Enforces safe update/query flows with conflict detection and resolution options.
- Maintains authoritative event records in `calendar.md` using YAML blocks.
- Automatic snapshots of recent changes for safety and audits.
- UI supports event management actions except creation (CLI-only for adding events).
- Includes import/export functionality for backup and restore.
Metadata
Frequently Asked Questions
What is Opys Calendar Skill?
A local markdown-backed calendar with CLI and optional two-way Google Calendar sync. It is an AI Agent Skill for Claude Code / OpenClaw, with 489 downloads so far.
How do I install Opys Calendar Skill?
Run "/install opys-calendar" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is Opys Calendar Skill free?
Yes, Opys Calendar Skill is completely free (open-source). You can download, install and use it at no cost.
Which platforms does Opys Calendar Skill support?
Opys Calendar Skill is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created Opys Calendar Skill?
It is built and maintained by 21J3phy (@21j3phy); the current version is v0.1.2.
More Skills