Security audit

iCloud

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for iCloud automation, but it grants sensitive Apple account access with a couple of under-scoped risk areas users should review first.

Install only if you are comfortable giving the pyicloud dependency access to your Apple login flow and iCloud data. Before use, prefer session-only mode unless you need local notes, ask the agent not to use family-device discovery unless required, and require explicit confirmation before any Find My action, upload, rename, delete, or bulk download.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: setup.md:23
Finding: Third-Party Authentication Package Installed Without Artifact Integrity Verification
Content: View full analysis
Remediation: View remediation
``` 2. Install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Resolve, pin, and hash all transitive dependencies rather than relying only on a top-level version pin. 4. Prefer an isolated virtual environment instead of modifying the user's general package environment. 5. Record the package filename and hash that were reviewed, because wheels and source distributions may have different contents. 6. Run dependency vulnerability and provenance checks as part of release review. 7. Keep credential entry local, but explicitly disclose that the selected dependency receives the Apple password and session data. ]]>

T05 · Unauthorized Access and Privilege Escalation

Note

Location: findmy-ops.md:7
Finding: Find My Discovery Enables Family-Device Scope by Default
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · auth-session.md (reported line 45)May include surrounding context.
PY

text
4. If prompted, storing password in keyring is allowed; never store in plain text files. 5. Re-run a read command to confirm trusted session is active. ## Session Failure Recovery

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
## Core Rules ### 1. Authenticate Locally, Never Through Chat - Never ask the user to paste Apple password, 2FA code, session token, or app password in conversation. - Use interactive local auth with terminal prompts or secure local input prompts only. ### 2. Start Read-Only, Then Escalate

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 20)May include surrounding context.
bash
mkdir -p ~/icloud touch ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md} chmod 700 ~/icloud chmod 600 ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · setup.md (reported line 21)May include surrounding context.
mkdir -p ~/icloud touch ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md} chmod 700 ~/icloud chmod 600 ~/icloud/{memory.md,operations-log.md,device-map.md,drive-map.md,safety-events.md}

text
4. If `memory.md` is empty, initialize from `memory-template.md`.

Static analysis

No suspicious patterns detected.