Security audit
Icloud Calendar Skill
Security checks across malware telemetry and agentic risk
Overview
The skill is mostly aligned with adding iCloud calendar events, but it has an under-disclosed code path that attempts to create a test calendar event when run without enough arguments.
Review the script before installing. It appears intended to send calendar events only to Apple's iCloud CalDAV service, but remove or avoid the demo auto-add behavior and configure credentials through environment variables or a private local secrets file rather than hard-coding them.
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.