中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 27/100
上次扫描：17 小时前 重新扫描
27 /100
Apple iCloud Suite
Apple iCloud 全套服务操作：日历、照片、iCloud Drive、设备查找、提醒事项
Legitimate iCloud management suite with minor documentation inconsistencies and credential handling concerns, but no confirmed malicious behavior. The status_wall daemon adds persistence risk that should be documented.
技能名称Apple iCloud Suite
分析耗时70.8s
引擎pi
✓
可以安装
Document the subprocess daemon behavior in SKILL.md. Standardize password usage guidance across scripts (main password vs app-specific password confusion). Consider pinning dependency versions.

安全发现 4 项

严重性 安全发现 位置
中危
Inconsistent credential type documentation 文档欺骗
Several scripts (icloud-photos.py, icloud-notes.py, icloud-reminders.py) document '应用专用密码' in their help text, but pyicloud requires the main Apple ID password + 2FA. Only icloud_calendar.py correctly documents app-specific password for CalDAV. status_wall.py is the only script that clearly distinguishes both credential types.
ICLOUD_PASSWORD - 应用专用密码
→ Standardize credential documentation: main password for pyicloud (photos/drive/devices), app-specific password for CalDAV (calendar)
 scripts/icloud-photos.py, scripts/icloud-notes.py, scripts/icloud-reminders.py:8
中危
Background daemon with undeclared persistence 权限提升
status_wall.py spawns a daemon process via subprocess.Popen that persists in the background, writing to ~/.status_wall.log and updating a shared family calendar at configurable intervals (default 15 min, commute mode 1 min). This persistence behavior is not declared in SKILL.md.
proc = subprocess.Popen([sys.executable, __file__, '_daemon'], stdout=log_file, stderr=log_file, start_new_session=True)
→ Declare the daemon capability in SKILL.md with explicit allowed-tools for shell:WRITE and document the shared calendar write behavior
 scripts/status_wall.py:152
低危
Dependency versions not pinned 供应链
SKILL.md install section uses 'pip install pyicloud' and 'pip install caldav icalendar' without version pins. This allows supply chain substitution attacks.
pip install pyicloud
→ Pin versions: pip install pyicloud==X.Y.Z caldav==X.Y.Z icalendar==X.Y.Z
 SKILL.md:25
低危
No allowed-tools declaration in SKILL.md 文档欺骗
SKILL.md declares tools (pyicloud, caldav, icloudpd) but provides no allowed-tools mapping for shell, filesystem, network, or environment resources. SKILL.md section header claims 'tools: pyicloud, caldav, icloudpd' but this doesn't map to the pi agent's capability model.
tools: pyicloud, caldav, icloudpd
→ Add explicit allowed-tools declaration mapping to pi's capability model
 SKILL.md:17
资源类型声明权限推断权限状态证据
文件系统 NONE WRITE ✓ 一致 scripts/status_wall.py writes to ~/.status_wall.json, ~/.status_wall.pid, ~/.sta…
网络访问 NONE READ ✓ 一致 Scripts make outbound API calls to iCloud (caldav.icloud.com, pyicloud) and Amap…
环境变量 NONE READ ✓ 一致 All scripts read ICLOUD_USERNAME, ICLOUD_PASSWORD, ICLOUD_APP_PASSWORD, ICLOUD_C…
命令执行 NONE WRITE ✓ 一致 status_wall.py:152 — subprocess.Popen spawns daemon; icloud_calendar.py:update_c…
1 高危 10 项发现
🔑
高危 API 密钥 疑似硬编码凭证
PASSWORD="xxxx-xxxx-xxxx-xxxx"
QUICKSTART.md:80
🔗
中危 外部 URL 外部 URL
https://appleid.apple.com
README.md:97
🔗
中危 外部 URL 外部 URL
https://lbs.amap.com/
README.md:98
🔗
中危 外部 URL 外部 URL
https://vdirsyncer.pimutils.org/
SKILL.md:125
🔗
中危 外部 URL 外部 URL
https://khal.readthedocs.io/
SKILL.md:126
🔗
中危 外部 URL 外部 URL
https://todoman.readthedocs.io/
SKILL.md:127
🔗
中危 外部 URL 外部 URL
https://caldav.icloud.com/
evals/results/calendar-with-skill.md:5
🔗
中危 外部 URL 外部 URL
https://restapi.amap.com/v3/geocode/regeo?
scripts/status_wall.py:335
📧
提示 邮箱 邮箱地址
[email protected]
QUICKSTART.md:24
📧
提示 邮箱 邮箱地址
[email protected]
scripts/icloud-notes.py:142

目录结构

18 文件 · 95.7 KB · 3153 行
Python 7f · 2128L Markdown 10f · 1019L JSON 1f · 6L
├─ ▾ 📁 config-templates
│ └─ 🐍 todoman-config.py Python 21L · 501 B
├─ ▾ 📁 evals
│ └─ ▾ 📁 results
│ ├─ 📝 calendar-with-skill.md Markdown 28L · 1.4 KB
│ └─ 📝 calendar-without-skill.md Markdown 19L · 888 B
├─ ▾ 📁 references
│ ├─ 📝 calendar.md Markdown 358L · 12.1 KB
│ ├─ 📝 drive.md Markdown 37L · 681 B
│ ├─ 📝 findmy.md Markdown 39L · 677 B
│ ├─ 📝 photos.md Markdown 69L · 1.3 KB
│ └─ 📝 scripts.md Markdown 128L · 3.2 KB
├─ ▾ 📁 scripts
│ ├─ 🐍 icloud_calendar.py Python 569L · 17.6 KB
│ ├─ 🐍 icloud_tool.py Python 203L · 5.6 KB
│ ├─ 🐍 icloud-notes.py Python 173L · 5.0 KB
│ ├─ 🐍 icloud-photos.py Python 276L · 8.2 KB
│ ├─ 🐍 icloud-reminders.py Python 202L · 5.7 KB
│ └─ 🐍 status_wall.py Python 684L · 23.5 KB
├─ 📋 _meta.json JSON 6L · 138 B
├─ 📝 QUICKSTART.md Markdown 105L · 2.1 KB
├─ 📝 README.md Markdown 109L · 2.9 KB
└─ 📝 SKILL.md Markdown 127L · 4.2 KB

依赖分析 4 项

包名版本来源已知漏洞备注
pyicloud unpinned pip 否 Open-source library, version not pinned
caldav unpinned pip 否 Open-source CalDAV library, version not pinned
icalendar unpinned pip 否 Open-source iCalendar library, version not pinned
icloudpd unpinned pip 否 Optional dependency for batch photo download, version not pinned

安全亮点

✓ All credential inputs are read from environment variables or interactive prompts, not hardcoded in source
✓ pyicloud is a well-known, publicly documented open-source library (not a custom implant)
✓ No base64-encoded strings, obfuscation, or anti-analysis techniques detected
✓ No ~/.ssh, ~/.aws, .env, or other sensitive credential path access
✓ No curl|bash remote script execution or eval() calls
✓ 2FA validation is enforced before accessing sensitive iCloud data
✓ Credentials are only transmitted to legitimate Apple iCloud and Amap API endpoints (HTTPS)
✓ Status wall writes to user-specified shared calendar, not hidden storage