by 安全扫描
OpenClaw
可疑
medium confidenceThe skill's documentation matches Cal.com API behavior, but it fails to declare the credentials and environment variables it actually expects (API keys, OAuth client secrets, webhook secret examples), which is an incoherence you should understand before installing.
评估建议
This skill appears to be correct documentation for the Cal.com API, but it omits declaring the credentials it expects. Before installing: 1) verify the skill's provenance (source is unknown) and that you trust it to handle your Cal.com credentials; 2) expect to provide a Cal.com API key (Bearer cal_...), and possibly OAuth client id/secret and a webhook secret — the registry should have declared these; 3) do not paste production API keys into chat or expose them in client-side code; store them i...详细分析 ▾
ℹ 用途与能力
The name/description and the SKILL.md content consistently describe Cal.com API v2 endpoints for bookings, slots, schedules, calendars, webhooks and event types — that purpose matches the provided request examples and reference docs. However, the skill metadata declares no required credentials or primary credential, while the runtime documentation explicitly requires a Bearer API key (cal_... ) and documents OAuth headers (x-cal-client-id, x-cal-secret-key) for platform integrations; those credentials are necessary for the stated purpose but are not declared in the skill requirements.
ℹ 指令范围
All instructions are scoped to calling Cal.com API endpoints and configuring webhooks; they do not instruct reading arbitrary files or system state. Example snippets reference storing/reading API keys and webhook secrets from environment variables (process.env, export CAL_API_KEY) but the skill does not declare these env vars as required — the instructions stay within API domain but assume access to secrets that the registry metadata omits.
✓ 安装机制
This is an instruction-only skill with no install spec and no code files to execute. That minimizes installation risk because nothing is downloaded or written to disk.
⚠ 凭证需求
The SKILL.md and reference files plainly expect API keys (Bearer cal_...), and optionally OAuth client id/secret and webhook HMAC secret for signature verification, yet the skill metadata lists no required env vars or primary credential. Requiring (or assuming) multiple secrets without declaring them is disproportionate and a visibility issue: users won't be prompted to provide the necessary credentials or warned about what will be used.
✓ 持久化与权限
The skill does not request persistent inclusion (always:false), does not include installation steps that modify other skills or system settings, and contains no code that would run autonomously outside normal agent invocation.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/2/18
Cal.com API v2 skill initial release - Provides integration with Cal.com API v2 for scheduling, bookings, and calendar management. - Supports event types, bookings, schedules, slots, calendar connection, and team/organization endpoints. - Includes guidance on authentication, pagination, rate limits, error handling, and webhooks. - Offers example requests and best practices for automating scheduling workflows.
● 无害
安装命令
点击复制官方npx clawhub@latest install calcom
镜像加速npx clawhub@latest install calcom --registry https://cn.longxiaskill.com