Trip Calendar

Add trip itineraries, flights, hotel check-ins, and activities to Google Calendar using gog CLI. Handles "add to calendar" and boarding pass parsing.

This skill appears to do what it says: it calls your local 'gog' CLI to create calendar events and will only add events after confirmation. Before installing/using it: (1) ensure you have the 'gog' CLI installed and authenticated to the Google account you want to modify — the skill does not request credentials itself; (2) be aware that boarding-pass parsing is underspecified: the agent may rely on built-in vision/OCR or ask you to provide extracted text — confirm how images are handled and whether they are sent to any external OCR service; (3) note the skill forces IST (+05:30) for created events — change may be needed if you want events in another timezone; (4) because boarding passes contain personal data, verify you are comfortable having the agent read those images and confirm calendar additions before proceeding.

Type: OpenClaw Skill Name: trip-calendar Version: 1.0.0 The skill is suspicious due to a significant shell injection vulnerability. The `SKILL.md` instructs the AI agent to construct and execute `gog` CLI commands using parameters (`--summary`, `--location`, `--description`) that will likely be populated with user-provided or parsed data. There are no explicit instructions for the agent to sanitize or escape this input, creating a clear path for an attacker to inject arbitrary shell commands into the `gog` execution, potentially leading to Remote Code Execution (RCE) on the host system.