Calendar Reminders

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

Audit 0.4.1 · source sha a79d9cd3663a · 15 Oct 2026Report an issue or request a re-scan

• PublisherInternLM GitHub organizationOwner of the repository this skill is read from
• Source folderInternLM/WildClawBench/skills/1/calendar-remindersThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdicta79d9cd3663aA new audit runs when the source changes
• Repository statusNot archivedLast push 27 days ago
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Calendar reminders pipeline: config-driven wrapper around gcalcli (Google Calendar) plus optional CalDAV source via vdirsyncer+khal, and a reminder planner that outputs a JSON plan for one-shot OpenClaw reminders.

---
name: calendar-reminders
description: Calendar reminders pipeline: config-driven wrapper around gcalcli (Google Calendar) plus optional CalDAV source via vdirsyncer+khal, and a reminder planner that outputs a JSON plan for one-shot OpenClaw reminders.
---

# gcalcli calendar wrapper + reminder planner

This skill provides:
- `scripts/calendar` — wrapper around `gcalcli`
- `scripts/calendar_reminder_plan.py` — produces a JSON plan for reminder scheduling
- `references/openclaw-calendar.example.json` — example config format

## Config

Copy the example config to a private location and edit it:

- Default path: `~/.config/openclaw/calendar.json`
- Override with env: `OPENCLAW_CALENDAR_CONFIG=/path/to/calendar.json`

## Requirements

- Required: `python3`, `gcalcli`
- Optional (for CalDAV/iCloud): `vdirsyncer`, `khal`

## Security notes (why ClawHub may flag this)

This skill *invokes external binaries* and is config-driven.

- The planner runs `gcalcli`/`khal` using `subprocess.check_output([...], shell=False)` (argument-list form; safe against shell injection from event titles).
- If you wire a cron job to run `vdirsyncerSyncCommand`, make sure you run it as an **argv list** (`subprocess.run(cmd_list, shell=False)`), not as a shell string.
- Only point `gcalcliPath` / `khalBin` to **trusted binaries** (prefer absolute paths). Don’t run untrusted paths.

## Auth (Google)

`gcalcli` requires OAuth. On headless servers you may need SSH port-forwarding.
The wrapper uses `--noauth_local_server` to print instructions.

## Reminder planning

The planner outputs a JSON blob describing reminders to schedule. A separate cron job
(or an agent turn) can read it and create one-shot OpenClaw reminders.

Defaults:
- Ignore birthdays.
- Timed events are considered important.
- All-day events only trigger reminders if their title matches configured keywords.

## Wiring a daily reminder scheduler (OpenClaw)

Create a daily cron job (e.g. 00:05 local time) that:

1) If CalDAV is enabled in config, runs the configured `vdirsyncer` sync command.
2) Runs `scripts/calendar_reminder_plan.py` to get a JSON plan.
3) For each planned reminder, creates a one-shot OpenClaw `systemEvent` reminder at `reminderAtUtc`.
4) Writes a small state file so you don’t schedule duplicates.

(Our skill intentionally provides the wrapper + planner; scheduling is left to your cron/agent wiring.)

Excerpt, first 2,395 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-15
   ✓SAFE B 89 / 100

   first audit · source a79d9cd3663a

Questions about Calendar Reminders

• github.com/InternLM/WildClawBench/tree/main/skills/1/calendar-re — the audited source at commit a79d9cd3663a and every finding aboveObserved · 15 Oct 2026

Spotted something wrong? Report a correction · Methodology