Apple Icloud Suite

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:56 AM UTC
• Version: 1.1.0

Overview

This iCloud skill can access and modify sensitive Apple account data and includes under-scoped background location/status sharing that users should review carefully before installing.

Install only if you trust this publisher with sensitive iCloud access. Do not provide your Apple ID primary password in chat; prefer local interactive authentication and secure keychain storage. Avoid enabling the status wall unless every tracked person has explicitly consented, you understand that location may be sent to AMap and published to a shared calendar, and you know how to stop the daemon and remove its config/log/session files. Use an isolated environment and review destructive calendar deletion and photo download behavior before allowing the agent to run those commands.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: references/calendar.md:265

Finding

Unsafe Solicitation of Primary Apple Account Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/status_wall.py:73

Finding

Plaintext Credential and Precise-Location Storage Without Permission Enforcement

Content

View full analysis

Remediation

View remediation

other

Error

• Location: scripts/status_wall.py:317

Finding

Disclosure of Precise Find My Coordinates to a Third-Party Geocoding Service

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: scripts/status_wall.py:157

Finding

Detached Location-Monitoring Daemon Persists Beyond the Initiating Session

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/icloud-photos.py:136

Finding

Cloud-Controlled Photo Filenames Permit Writes Outside the Download Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/icloud_calendar.py:451

Finding

Broad Calendar Keyword Deletion Lacks Preview and Confirmation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party Packages Are Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/calendar.md:72

Finding

Reminder Setup Recommends a Plaintext Password File Without Access Controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (63)

Tainted flow: 'req' from os.environ.get (line 336, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/status_wall.py (reported line 337)May include surrounding context.

python

})
        url = f'https://restapi.amap.com/v3/geocode/regeo?{params}'
        req = urllib.request.Request(url, headers={'User-Agent': 'StatusWall/1.0'})
        with urllib.request.urlopen(req, timeout=5) as resp:
            data = json.loads(resp.read().decode())

        if data.get('status') != '1':

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant highlights a concrete security-relevant mismatch: the description implies broad CRUD management across calendars, Drive, device finding, and reminders, while the documented scripts appear narrower and in some cases read/list-only. Such misrepresentation can cause excessive trust and authorization for access to sensitive personal data, files, and device metadata.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill directly discusses handling Apple ID credentials via environment variables or keychain, which is credential access territory in a highly sensitive consumer account context. Even if intended for legitimate authentication, guidance that normalizes pulling secrets into execution context raises the risk of accidental disclosure through process listings, logs, shell history, or downstream scripts.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

🔴 密码安全：从环境变量读取，不硬编码

bash

export ICLOUD_EMAIL="[e-mail]"
export ICLOUD_PASSWORD="xxx"  # 或用 keychain

4. pyicloud 认证

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation materially expands an iCloud calendar skill into a persistent surveillance system that continuously polls GPS location, derives semantic places, and broadcasts user status to a shared calendar. This goes far beyond the declared calendar-management purpose and creates a high-risk capability for covert tracking, stalking, and non-consensual monitoring of a household member.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document instructs background GPS polling every 15 minutes, escalating to every minute during commutes, with automatic status updates, but does not present this as a strong privacy warning or obtain ongoing informed consent. Persistent location collection and sharing is highly invasive and can expose routines, workplaces, and home presence to abuse.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The setup flow incrementally normalizes trust, then escalates to collecting multiple secrets and enabling a persistent monitoring daemon. This pattern is dangerous because it socially engineers users into surrendering credentials and enabling continuous surveillance under the guise of benign family/calendar convenience.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The setup instructions explicitly ask the user for their Apple ID primary password to enable ongoing Find My automation. Requesting a primary account password inside skill documentation is extremely dangerous because it facilitates credential harvesting, account takeover, access to device locations, and compromise of the broader Apple ecosystem tied to the account.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

The skill directly instructs collection of highly sensitive credentials, including the Apple ID primary password and app-specific password, in plain setup text. This is credential harvesting behavior with severe consequences: account compromise, access to personal data, device tracking, and downstream abuse of the victim's Apple services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script implements a long-running daemon that automatically reads calendars, polls Find My location, infers status, and writes updates into a shared calendar without per-action user invocation. That materially exceeds the declared skill scope of user-requested iCloud operations and creates a covert background automation channel for sensitive personal data.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This logic continuously tracks a person's GPS location, infers home/work/commute behavior, and publishes that derived status to a shared calendar. In skill context, this is especially dangerous because it operationalizes family-member surveillance and exposes sensitive routine/location data far beyond ordinary calendar or file management.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The entire quickstart is written in Chinese and does not offer any language choice or note that the skill is intended only for Chinese-speaking users. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable locale/language constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Nearly all user-facing documentation is presented only in Chinese, with no indication that another language is available or that Chinese is required for a justified region-specific reason. This can violate language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README introduces an external AMap reverse-geocoding dependency that sends device coordinates to a third-party service, but this data flow is not disclosed in the manifest description. Undocumented third-party sharing of precise location data is dangerous because users may believe all processing stays within Apple/iCloud when in fact sensitive GPS data is exposed to another provider.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README documents a background 'status wall' capability that continuously polls Find My GPS data, derives semantic locations, and infers commuting/presence states for family-collaboration use. This materially expands the skill from ordinary iCloud file/calendar operations into ongoing presence monitoring, which is highly privacy-sensitive and not reflected in the stated skill scope, increasing the risk of covert surveillance or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README describes continuous device-location retrieval, one-minute polling, and home/work presence detection without an explicit privacy warning or consent language. In the context of an iCloud skill, this is especially dangerous because it enables continuous tracking of a person's movements and routines, which can facilitate stalking, coercive monitoring, or other privacy harms if used without clear authorization.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares powerful capabilities through its instructions and example commands—environment variable access, shell execution, file reads/writes, and network access—but does not scope or constrain them via an explicit permission model. In a credentialed iCloud context, missing tool restrictions increases the chance of overbroad access, unintended data exposure, or unsafe command execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad and overlap with common requests like checking today's schedule or adding an event. Overbroad invocation can cause the skill to activate in routine contexts and access calendars, photos, files, or location data when a narrower or different tool would have been more appropriate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes device-finding and broad personal data access but does not prominently warn about the privacy implications of retrieving location, photos, files, and calendar information. Absent clear warnings and consent boundaries, users may unknowingly authorize highly sensitive account and location access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the use of Apple ID credentials and session caching but does not provide strong safety guidance about secret handling, storage lifetime, or leakage risk. In an iCloud context, compromised credentials or session tokens can expose photos, files, calendars, reminders, and device-location data across the user's account.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: QUICKSTART.md:80

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:25

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/calendar.md:28

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/icloud-notes.py:143

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/icloud-photos.py:206