Apple Cal Anywhere

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:14 PM UTC
• Version:
  1.3.1

Overview

This skill is a disclosed Apple Calendar command-line integration that can read and change calendar data when you provide iCloud credentials.

Install only if you want an agent or CLI to manage your iCloud Calendar. Use an Apple app-specific password, avoid putting it in shared shell profiles, review create/update/delete/attach commands before running them, and set APPLECAL_ATTACH_DIR if you want attachment uploads limited to one safe folder.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill declares runtime requirements for Python and an environment variable carrying a password, and its documented behavior inherently requires network access to iCloud and shell execution of a local script, but it does not explicitly declare these permissions. This creates a transparency and least-privilege problem: an agent or reviewer may underestimate the skill's access to credentials, local execution, and external services.

VirusTotal

64/64 vendors flagged this skill as clean.