Apple iCloud Suite
Audited by Socket on Mar 11, 2026
1 alert found:
Obfuscated FileThe skill coherently implements its stated purpose of providing iCloud access via pyicloud, CalDAV, and icloudpd, with an ambitious add-on of a background status wall for family coordination. However, credential handling is a major security concern: the design requires collecting and using Apple ID credentials and passwords, with potential exposure through prompts, logs, or poorly bounded data flows. The background automation (status_wall) adds risk due to autonomous actions without explicit per-action user confirmation. Third-party API key usage (高德) is reasonable for geocoding but increases the risk surface if keys are mishandled. Overall, the footprint is suspicious to high-risk due to credential collection and autonomous background behavior, and it should be restricted or redesigned to use token-based or app-specific authentication where possible, with explicit user consent and secure secret handling.