Security audit

iCloud Reminders

Security checks for vulnerabilities and agentic risk

Overview

This iCloud Reminders skill is functionally coherent, but it asks users to install an unaudited mutable third-party binary that handles Apple ID credentials and reusable iCloud sessions.

Review this carefully before installing. Only use it if you trust the Homebrew tap and CLI publisher, understand that it can modify or delete iCloud Reminders, and are prepared to protect the credentials file, session.json, and any exported session archives like account login secrets. Prefer interactive authentication or an OS credential store over a plaintext password file, and avoid sharing exported sessions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:10
Finding: Unpinned Third-Party Binary Installed from a Personal Homebrew Tap## Vulnerability Details **File Location**: `SKILL.md`, lines 10-14 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```yaml install: - kind: brew tap: tarekbecker/tap formula: icloud-reminders bins: [reminders] ``` ### Technical Analysis The Skill installs the `reminders` executable from a third-party personal Homebrew tap. It does not pin an immutable formula revision, source commit, binary checksum, or cryptographic signature. The project contains only `SKILL.md`; neither the executable's source code nor its Homebrew formula is available in the audited artifact. This is particularly sensitive because the installed executable is expected to process an Apple ID password, 2FA authentication, reusable session cookies, and iCloud Reminders data. A future or compromised release could therefore execute arbitrary code under the invoking user's account and access all credentials and files available to that user. The audit found no evidence that the current external package is malicious. The vulnerability is the unauditable and mutable supply-chain trust relationship created by the installation instructions. ### Attack Path 1. An attacker compromises the personal Homebrew tap, its release account, or an upstream artifact referenced by its formula. 2. The attacker publishes a modified formula or binary under the expected package name. 3. A user follows the Skill's installation or upgrade instructions. 4. Homebrew retrieves and installs the altered executable without verification against a checksum or version committed to this Skill. 5. When the user invokes `reminders auth` or another command, the executable runs with the user's privileges. 6. The altered executable can capture the Apple ID password, copy reusable session cookies, modify reminders, read user-accessible files, or execute additional local actions. ### Impact Assessment Successful exploitati ...[truncated 479 chars]
Remediation: ## Remediation Suggestions - Pin the dependency to an immutable release and verified source commit. - Record and validate SHA-256 checksums for downloaded artifacts. - Verify a cryptographic release signature from a documented trusted identity. - Include the Homebrew formula and relevant CLI source in the reviewable project, or link them to immutable commit identifiers. - Prevent unattended upgrades from silently replacing the audited executable. - Prefer a trusted package registry or official distribution channel where available. - Document the precise network endpoints and local files accessed by the binary. - Perform a separate source audit of the CLI because this artifact does not contain its implementation.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:44
Finding: Apple ID Password May Be Stored in a Plaintext Credential File## Vulnerability Details **File Location**: `SKILL.md`, lines 44-49 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```markdown Credentials are resolved in this order: 1. `ICLOUD_USERNAME` / `ICLOUD_PASSWORD` environment variables 2. `~/.config/icloud-reminders/credentials` file (export KEY=value format) 3. Interactive prompt (fallback) ``` ### Technical Analysis The Skill documents persistent storage of an Apple ID password in a shell-style plaintext file. It does not require restrictive permissions, validate file ownership, reject symbolic links, or recommend an operating-system credential store such as macOS Keychain. Environment variables are also not an ideal long-term secret-storage mechanism because they may be inherited by child processes and exposed through diagnostics, process inspection facilities, crash reports, or debugging tools depending on the operating environment. Authentication is necessary for the declared iCloud functionality, so accessing credentials is functionally justified. Persisting the account password in plaintext, however, is not the minimum-risk method. A reusable authenticated session or operating-system secret store can support the functionality while reducing exposure of the primary Apple account password. ### Attack Path 1. A user creates `~/.config/icloud-reminders/credentials` as instructed and stores `ICLOUD_USERNAME` and `ICLOUD_PASSWORD` in plaintext. 2. The file is created with permissive permissions, copied into an unencrypted backup, collected by diagnostic software, or made reachable through an unsafe symbolic-link or ownership condition. 3. Another local user or malicious process reads the credential file. 4. The attacker obtains the Apple ID username and password. 5. The attacker attempts authentication to Apple services and may use social engineering or other means to overcome 2FA, or waits for access to a related ...[truncated 707 chars]
Remediation: ## Remediation Suggestions - Store the Apple ID password in macOS Keychain or another operating-system-backed credential manager. - Prefer short-lived or revocable authentication tokens and cached sessions over persistent storage of the primary password. - Avoid environment variables for persistent credential handling. - If file-based credentials must remain supported: - Require file mode `0600`. - Verify that the file is owned by the current user. - Reject symbolic links, non-regular files, and files located in unsafe directories. - Create the configuration directory with mode `0700`. - Refuse to proceed when permissions are broader than required. - Warn users that the file contains a plaintext account password. - Exclude credential and session files from source control, logs, diagnostics, and unencrypted backups. - Never print credential values in normal or verbose output. - Document credential rotation and revocation procedures following suspected exposure.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly documents exporting and importing iCloud session cookies as a shareable archive but does not warn that these session artifacts can grant ongoing account access without the Apple ID password. In the context of a reminders-management skill tied to a personal iCloud account, omission of handling guidance materially increases the chance that users exfiltrate or share bearer-equivalent credentials insecurely.

Static analysis

No suspicious patterns detected.