iCloud Find My

• Analyzed: May 13, 2026, 3:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 96833aaa12fadbbdaa818c0f3e20ef164698a6df42e801fd8268ac2765c8d799
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the instruction in `SKILL.md` to use `eval()` on parsed output from the `icloud` CLI. While the immediate intent appears to be benign (parsing a Python dictionary string for location data), `eval()` is an inherently dangerous function when used with input that could potentially be controlled or manipulated by an external source. This instruction teaches the AI agent a risky pattern, creating a potential code injection vulnerability if the `icloud` CLI output could ever be maliciously crafted (e.g., via a compromised device name or location data).