Security audit

apple-calendar-pro

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its calendar-management purpose, but it needs review because a URL-validation weakness could expose the user's iCloud app password while the tool can read and change calendars.

Install only if you are comfortable giving this skill an Apple app-specific password with access to your calendars. Prefer a dedicated app-specific password that you can revoke, avoid storing it in a shell profile, use an isolated Python environment with reviewed or pinned dependencies, and treat create/update/delete commands as capable of changing real calendar data. The URL-validation issue should be fixed before broad or unattended use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/applecal.py:481
Finding: Basic Authentication Credentials Can Be Forwarded to Unvalidated CalDAV Discovery URLs
Content: View full analysis
requests.Response: """Wrapper around session.request with default timeout.""" kwargs.setdefault("timeout", DEFAULT_TIMEOUT) logger.debug("%s %s", method, url) resp = self.session.request(method, url, **kwargs) logger.debug("→ %s", resp.status_code) return resp ``` ```python parsed = urlparse(resp.url) server_root = f"{parsed.scheme}://{parsed.netloc}" self.principal_url = href if href.startswith("http") else urljoin(server_root, href) # 2. Calendar Home, Outbox, and User Addresses body = ''' ''' resp = self._request("PROPFIND", self.principal_url, headers={"Depth": "0"}, data=body) resp.raise_for_status() root = parse_xml(resp.text) # Home home_el = root.find(".//{urn:ietf:params:xml:ns:caldav}calendar-home-set") home_href = get_href(home_el) if not home_href: ...[truncated 2974 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Unpinned Third-Party Dependency Installation Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (35)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 24)May include surrounding context.
bash
pip3 install requests # optional (recommended off-macOS): pip3 install keyring

2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
bash
pip3 install requests # optional (recommended off-macOS): pip3 install keyring

2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.
bash
pip3 install requests # optional (recommended off-macOS): pip3 install keyring

2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 259)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 261)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 263)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 264)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 265)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 266)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 268)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 274)May include surrounding context.
python
```bash pip3 install requests # optional (recommended off-macOS): pip3 install keyring ``` ### 2. Generate an app-specific password

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
`scripts/applecal.py`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
`scripts/applecal.py`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
`scripts/applecal.py`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
`scripts/applecal.py`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
`scripts/applecal.py`

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · _meta.json (reported line 9)May include surrounding context.
json
"author": "OpenClaw Fleet", "license": "MIT", "platform": "macos,linux,windows", "auth": "keychain (macOS) or APPLECAL_PASSWORD env var (cross-platform)", "requires": ["python3", "requests"], "keywords": ["calendar", "apple", "icloud", "caldav", "ics", "schedule"], "commands": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 61)May include surrounding context.
python
"author": "OpenClaw Fleet", "license": "MIT", "platform": "macos,linux,windows", "auth": "keychain (macOS) or APPLECAL_PASSWORD env var (cross-platform)", "requires": ["python3", "requests"], "keywords": ["calendar", "apple", "icloud", "caldav", "ics", "schedule"], "commands": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 69)May include surrounding context.
python
"author": "OpenClaw Fleet", "license": "MIT", "platform": "macos,linux,windows", "auth": "keychain (macOS) or APPLECAL_PASSWORD env var (cross-platform)", "requires": ["python3", "requests"], "keywords": ["calendar", "apple", "icloud", "caldav", "ics", "schedule"], "commands": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 240)May include surrounding context.
python
"author": "OpenClaw Fleet", "license": "MIT", "platform": "macos,linux,windows", "auth": "keychain (macOS) or APPLECAL_PASSWORD env var (cross-platform)", "requires": ["python3", "requests"], "keywords": ["calendar", "apple", "icloud", "caldav", "ics", "schedule"], "commands": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 480)May include surrounding context.
python
"author": "OpenClaw Fleet", "license": "MIT", "platform": "macos,linux,windows", "auth": "keychain (macOS) or APPLECAL_PASSWORD env var (cross-platform)", "requires": ["python3", "requests"], "keywords": ["calendar", "apple", "icloud", "caldav", "ics", "schedule"], "commands": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 10)May include surrounding context.
python
- Event CRUD (List, Create, Update, Delete) - RFC 8607 Managed Attachments (iPhone/iPad compatible) - Free/Busy lookup (CalDAV scheduling + event-derived fallback) - Keychain-based auth (no plaintext passwords) - JSON-stable output for easy agent consumption Requirements:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 245)May include surrounding context.
python
- Event CRUD (List, Create, Update, Delete) - RFC 8607 Managed Attachments (iPhone/iPad compatible) - Free/Busy lookup (CalDAV scheduling + event-derived fallback) - Keychain-based auth (no plaintext passwords) - JSON-stable output for easy agent consumption Requirements:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 250)May include surrounding context.
python
- Event CRUD (List, Create, Update, Delete) - RFC 8607 Managed Attachments (iPhone/iPad compatible) - Free/Busy lookup (CalDAV scheduling + event-derived fallback) - Keychain-based auth (no plaintext passwords) - JSON-stable output for easy agent consumption Requirements:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/applecal.py (reported line 271)May include surrounding context.
python
- Event CRUD (List, Create, Update, Delete) - RFC 8607 Managed Attachments (iPhone/iPad compatible) - Free/Busy lookup (CalDAV scheduling + event-derived fallback) - Keychain-based auth (no plaintext passwords) - JSON-stable output for easy agent consumption Requirements:

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Credential Access

2. Generate an app-specific password

Credential Access

2. Generate an app-specific password

Credential Access

2. Generate an app-specific password

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Ae1

Ae1

Ae1

Ae1

Ae1

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis