iCloud

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:09 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for iCloud automation, but it grants sensitive Apple account access with a couple of under-scoped risk areas users should review first.

Install only if you are comfortable giving the pyicloud dependency access to your Apple login flow and iCloud data. Before use, prefer session-only mode unless you need local notes, ask the agent not to use family-device discovery unless required, and require explicit confirmation before any Find My action, upload, rename, delete, or bulk download.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: setup.md:23
• Finding: Third-Party Authentication Package Installed Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `setup.md:23-28`; dependency declaration also appears at `SKILL.md:7` **Vulnerability Type**: Supply-chain integrity weakness **Risk Level**: Medium ### Vulnerable Code `setup.md:23-28`: ```bash python3 -m pip install --user pyicloud==2.4.1 python3 - <<'PY' from pyicloud import PyiCloudService print("pyicloud import OK") PY ``` `SKILL.md:7`: ```yaml metadata: {"clawdbot":{"emoji":"☁️","requires":{"bins":["python3"]},"install":[{"id":"pyicloud","kind":"pip","package":"pyicloud==2.4.1","label":"Install pyicloud 2.4.1 (pip)"}],"os":["linux","darwin","win32"]}} ``` ### Technical Analysis The workflow installs `pyicloud` directly from the Python package index and immediately imports it. Pinning the package to version `2.4.1` limits version drift, but it does not verify the cryptographic hash of the downloaded distribution. The project also provides no hash-locked dependency manifest covering transitive dependencies. This package executes in the user's security context and is subsequently entrusted with the user's Apple ID, password, session state, and iCloud API access. If the selected distribution or one of its dependencies were compromised at the package source, hosting layer, or release-account level, malicious code could execute during installation or import. This finding does not establish that `pyicloud==2.4.1` is malicious. It identifies the absence of artifact-level integrity controls for a security-sensitive authentication dependency. ### Attack Path 1. An attacker compromises the relevant package release, distribution artifact, package-maintainer account, or an unresolved transitive dependency. 2. The user follows the documented setup procedure and runs `pip install --user pyicloud==2.4.1`. 3. Pip downloads and installs the artifact without checking it against a project-supplied expected hash. 4. The workflow imports the installed package, allowing package code to execute with the user's local ...[truncated 745 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish a reviewed, hash-locked requirements file containing the expected SHA-256 hashes for every accepted distribution: ```text pyicloud==2.4.1 --hash=sha256:<reviewed-distribution-hash> ``` 2. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Resolve, pin, and hash all transitive dependencies rather than relying only on a top-level version pin. 4. Prefer an isolated virtual environment instead of modifying the user's general package environment. 5. Record the package filename and hash that were reviewed, because wheels and source distributions may have different contents. 6. Run dependency vulnerability and provenance checks as part of release review. 7. Keep credential entry local, but explicitly disclose that the selected dependency receives the Apple password and session data. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: findmy-ops.md:7
• Finding: Find My Discovery Enables Family-Device Scope by Default<![CDATA[ ## Vulnerability Details **File Location**: `findmy-ops.md:7-17` **Vulnerability Type**: Excessive account-data scope **Risk Level**: Low ### Vulnerable Code ```bash python3 - <<'PY' import getpass from pyicloud import PyiCloudService user = input("Apple ID: ").strip() pwd = getpass.getpass("Apple password: ") api = PyiCloudService(user, pwd, with_family=True) for dev in api.devices: print(dev.content.get("id"), dev.content.get("name")) PY ``` The workflow subsequently instructs: ```text Extract and persist only stable identifiers (device ID, display name mapping). ``` ### Technical Analysis The explicit `with_family=True` setting broadens Find My discovery to include family-related device data available through the authenticated account. This conflicts with least-privilege operation when a request concerns only the account holder's own device. The workflow does not require separate confirmation before enabling family scope. It prints every returned device's stable identifier and display name, and the following instruction permits those values to be persisted. Consequently, data associated with family members may be unnecessarily displayed or retained even when it is unrelated to the user's requested operation. The code does not automatically invoke `play_sound()`, `display_message(...)`, or `lost_device(...)`; those operations remain subject to the documented confirmation controls. The confirmed issue is excessive discovery and potential retention, not automatic remote device modification. ### Attack Path 1. A user requests discovery or status information for one of their own devices. 2. The documented command authenticates with `with_family=True` without first obtaining approval for family-device access. 3. The API returns devices available through the broader family scope. 4. The loop prints each returned device name and stable identifier. 5. An operator following the persistence guidance may store identifiers for unrelated family devi ...[truncated 657 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable family-device discovery by default by omitting `with_family=True` or using `with_family=False` where supported. 2. Require explicit user approval before enabling family scope. The prompt should explain that family-device names and identifiers may be returned. 3. Filter discovery results to the minimum device set needed for the requested task. 4. Persist only the identifier of a device that the user explicitly selected; do not retain all discovered family-device mappings. 5. Redact unnecessary identifiers from logs and terminal summaries. 6. Add a retention procedure for deleting obsolete device mappings. 7. Continue requiring exact device-ID confirmation before every remote Find My action. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

PY
```

4. If prompted, storing password in keyring is allowed; never store in plain text files.
5. Re-run a read command to confirm trusted session is active.

## Session Failure Recovery

• Confidence: 80% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Core Rules

### 1. Authenticate Locally, Never Through Chat
- Never ask the user to paste Apple password, 2FA code, session token, or app password in conversation.
- Use interactive local auth with terminal prompts or secure local input prompts only.

### 2. Start Read-Only, Then Escalate

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
mkdir -p ~/icloud
touch ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}
chmod 700 ~/icloud
chmod 600 ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}
```

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

mkdir -p ~/icloud
touch ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}
chmod 700 ~/icloud
chmod 600 ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}
```

4. If `memory.md` is empty, initialize from `memory-template.md`.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.