Security audit
iCloud Calendar
Security checks for vulnerabilities and agentic risk
Overview
This plugin does what it claims: connects to iCloud Calendar so an agent can read and optionally modify calendar events.
Install only if you want OpenClaw to access your calendar. Prefer an Apple app-specific password stored in an environment variable or SecretRef, enable readOnly if you only need viewing, and use the calendar allowlist to limit which calendars the agent can see or modify.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.