Security checks across malware telemetry and agentic risk
This iCloud skill is partly legitimate, but it also enables continuous location/status tracking with broad account credentials and shared-calendar publishing.
Install only if you deliberately want broad iCloud access and the status-wall tracking behavior. Avoid pasting your primary Apple ID password into chat; prefer app-specific credentials where possible, keep the daemon off unless needed, confirm every tracked person consents, understand that precise location may be sent to AMap, and review or clear ~/.pyicloud/ and ~/.status_wall* files after use.
member = cfg["member_name"]
title = f"👤 {member}: {status_text}"
r = subprocess.run(
['python3', cal_script, 'search', f'👤 {member}', '-c', target],
capture_output=True, text=True
))
# 写入新状态
r = subprocess.run(
['python3', cal_script, 'new', 'today', title, '-c', target],
capture_output=True, text=True
)# 删除旧状态
if '找到 0 个' not in r.stdout and '没有找到' not in r.stdout:
subprocess.run(
['python3', cal_script, 'delete', f'👤 {member}', '-c', target],
capture_output=True, text=True
)output_path = os.path.join(output_dir, photo.filename)
with open(output_path, 'wb') as f:
f.write(download.raw.read())
file_size = os.path.getsize(output_path) / 1024 / 102465/65 vendors flagged this skill as clean.