ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

iCloud Reminders

v0.1.6

Manage Apple iCloud Reminders via CloudKit API. Use for listing, adding, completing, deleting reminders, managing lists, and hierarchical subtasks. Works wit...

⭐ 0· 646·1 current·1 all-time
byTarek Becker@tarekbecker
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
✓
Purpose & Capability
The skill is an instruction-only wrapper that relies on a 'reminders' binary to talk to CloudKit; requiring a binary named 'reminders' and offering Homebrew installation is consistent with the stated purpose of managing iCloud Reminders.
ℹ
Instruction Scope
SKILL.md limits actions to iCloud Reminders (auth, list, add, edit, complete, delete, session export/import, sync). It references reading/writing its own config files (~/.config/icloud-reminders/credentials and ~/.config/icloud-reminders/session.json) and optionally using ICLOUD_USERNAME/ICLOUD_PASSWORD environment variables. There are no instructions to read unrelated system files or exfiltrate data, but the ability to export session.tar.gz is sensitive because session exports can be reused to access the account.
ℹ
Install Mechanism
Install uses Homebrew formula 'icloud-reminders' from the third‑party tap 'tarekbecker/tap'. Homebrew is a common packaging method, but using a non‑official tap increases the need to review the formula/tap contents before installing.
!
Credentials
SKILL.md documents optional use of ICLOUD_USERNAME and ICLOUD_PASSWORD environment variables and a credentials file under ~/.config/icloud-reminders, but the registry metadata lists no required env vars or primary credential. This mismatch is problematic: the skill legitimately needs Apple ID credentials for auth, but the registry did not declare them. Storing Apple ID passwords in env vars or plaintext files is sensitive and should be done with caution; session files and exported session archives are also high‑value credentials.
✓
Persistence & Privilege
The skill does not request always:true and does not claim to change other skills or system-wide settings. It creates/uses session files within its own config directory, which is expected for credential/session caching.
What to consider before installing
This skill is mostly coherent with its purpose but requires handing over your Apple ID credentials or session files (sensitive data). Before installing: 1) Inspect the Homebrew tap/formula (tarekbecker/tap) and the linked GitHub repo to verify the code and packaging; do not install blindly from an unfamiliar tap. 2) Prefer interactive auth (reminders auth) over setting ICLOUD_USERNAME/ICLOUD_PASSWORD as environment variables or storing plaintext credentials in ~/.config/icloud-reminders/credentials. 3) Treat ~/.config/icloud-reminders/session.json and any exported session.tar.gz as secret — do not share them. 4) If you must use env vars or credential files, ensure restrictive file permissions and consider creating a dedicated Apple ID for automation. 5) The registry metadata should have declared the credential requirements; ask the publisher/registry maintainer to correct the metadata if you plan to use this skill. If you cannot review the tap/formula or are uncomfortable providing Apple credentials, avoid installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk978fpq4ezgxerqnfmdxejawsd83r7ny

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

✅ Clawdis
Binsreminders

Install

Homebrew
Bins: reminders
brew install tarekbecker/tap/icloud-reminders

Comments