Apple iCloud 全套服务操作：日历、照片、iCloud Drive、设备查找、提醒事项。 Use when: (1) 用户要求查看/创建/修改/删除日历事件或日程, (2) 用户说"帮我看看今天有什么安排"/"加个日程"/"改一下会议时间", (3) 用户要求查找/下载/管理 iCloud 照片, (4...

Before installing or enabling this skill, consider the following: - Metadata mismatch: The skill registry declares no required credentials, but the docs/scripts require Apple ID credentials (main password for pyicloud and/or an app-specific password for CalDAV) and an AMAP API key. Treat that omission as a red flag and ask the publisher to correct it. - Minimize credential exposure: Prefer using an app-specific password for calendar/CalDAV access rather than your Apple ID main password. Do NOT give your primary Apple ID password to untrusted code unless you fully trust the author. If you must test, use a throwaway/test Apple account. - Location and persistence: The status_wall feature runs as a background/daemon process that polls device location frequently and can automatically create/update calendar events. If you enable this, expect continuous location collection and automatic changes to calendars — only enable if you understand and accept the privacy implications. - Verify source and review code: The repository includes multiple Python scripts. If you plan to run them, review status_wall.py and any code that writes ~/.status_wall.json, ~/.status_wall.pid, ~/.status_wall.log or the ~/.pyicloud/ cache to confirm what is stored and where. Running in an isolated environment (VM or throwaway user account) is safer. - Limit autonomous invocation: If the platform allows, disable autonomous invocation for this skill or require explicit user confirmation for operations that collect location or update calendars. Require the skill to not persist credentials in plaintext and to document exactly what is stored and how to revoke it. - Alternative approach: For calendar operations, prefer CalDAV with app-specific passwords; for photos/drive, prefer tools that use OAuth or limited-scope tokens when available. For reverse geocoding, supply your own AMAP key only if you trust the operator, or do geocoding client-side using a service you control. If you want me to produce a short checklist or a suggested minimal permissions/configuration to safely run this skill (e.g., environment variables to set, what to inspect in status_wall.py), I can provide that.

Type: OpenClaw Skill Name: apple-icloud-suite Version: 1.0.0 The bundle provides tools for managing iCloud services but includes a 'Status Wall' feature (scripts/status_wall.py) that performs real-time GPS tracking and requires the user's main Apple ID password. The instructions in SKILL.md and references/calendar.md (Scenario 4) direct the AI agent to solicit highly sensitive credentials, including the main Apple ID password and a third-party API key (Amap/高德), to enable background location monitoring. While these capabilities are aligned with the stated 'family collaboration' purpose, the requirement for the primary account password and the implementation of a location-tracking daemon pose significant security and privacy risks. The script communicates with restapi.amap.com for geocoding services.