Skills/Glama/icloud-mcp

icloud-mcp@0.1.0

VERIFIED· not started

Publisher claims: "Enables secure access to iCloud Mail through tools for listing folders, searching, reading, sending, marking, and trashing messages, with confirmation required for sending and deletion." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher dlife · publishing for 1 daysInstalls 0Last detonated 21 h ago
$npx skills add icloud-mcp
WatchReport an issue

Coverage

Not started: dependency install failed; the server itself was not observed.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · the dependency install step · every file read, file written and host contacted by what ran
Not tested
server startup · the tool list · tool behavior

What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GMAIL_APP_PASSWORDMCP_AUTH_TOKENConfiguration, not credentials: GMAIL_ADDRESS, ICLOUD_MAIL_ADDRESS, ICLOUD_MAIL_USER, ICLOUD_TIMEZONE, MCP_ALLOWED_HOSTS, MCP_DATA_DIR, MCP_HOST, MCP_MAX_ATTACHMENT_CHARS, MCP_MAX_ATTACHMENT_MB, MCP_PORT
Where it talks to
icloud.com (its own)Also apple.com, google.com, voorbeeld.nl — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
server startup · the tool list · tool behavior

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com, google.com, voorbeeld.nl as well as its own vendor. The guard injects GMAIL_APP_PASSWORD, MCP_AUTH_TOKEN only into requests to icloud.com (and its subdomains) and refuses the rest.

$vet-skills run --secrets GMAIL_APP_PASSWORD=icloud.com,MCP_AUTH_TOKEN=icloud.com -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-13 and scored it 84/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.0sprocessexec /usr/bin/dirname
0.0sprocessexited 127: ./setup.sh: line 8: docker: command not found
0.2sprocessdependency install exit 1 ·
0.2sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.2sprocessexec /usr/bin/dirname
0.2sprocessexited 127: ./setup.sh: line 8: docker: command not found

Static findings

HIGH
Access to sensitive file pathsscripts/backup.sh:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files[ -f "$HERE/.env" ] || { echo ".env niet gevonden in $HERE" >&2; exit 1; }Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/setup.py:1 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Interactieve installatiewizard / interactive setup wizard: maakt .env aan en test de logins.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandDockerfile:6 · File permission modification command — agent changes file ownership/permissionsRUN pip install . && useradd -r -u 10001 app && mkdir /data && chown app /dataFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/setup.py:175 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesparser.add_argument("--out", default=".env")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsscripts/backup.sh:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp "$HERE/.env" "$TMP/env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup.sh:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Installatiewizard / setup wizard: maakt .env aan en test je logins.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/setup.py:174 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesparser = argparse.ArgumentParser(description="Maakt .env aan voor icloud-mcp.")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectiondocker-compose.yml:16 · Prompt injection — known jailbreak technique reference · informational: not an instruction file# en vervang 'caddy-net' door de naam van dat netwerk; Caddy wijst dan naar icloud-mcp:8000.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathsdocker-compose.yml:6 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv_file: .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:61 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileIn de projectmap: `git pull`, dan `sudo docker compose up -d --build --force-recreate`.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
Access to sensitive file pathstests/test_setup.py:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesout = tmp_path / ".env"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/setup.py:3 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesGebruik / usage: icloud-mcp-setup [--out .env] [--lang nl|en] [--skip-checks]Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File permission modification commandscripts/backup.sh:22 · File permission modification command — agent changes file ownership/permissionschmod 600 "$DEST/icloud-mcp-$STAMP.tgz"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/server.py:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesraise RuntimeError("Gmail is niet ingesteld (GMAIL_ADDRESS en GMAIL_APP_PASSWORD in .env)")Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/icloud_mcp/setup.py:99 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files"""Zelfde volgorde en uitleg als .env.example, met de ingevulde waarden."""Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:81 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- Opnieuw koppelen met Claude: verwijder de connector en voeg hem opnieuw toe; je logt dan weer in met `MCP_OWNER_PASSWORD`.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionREADME.md:54 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileDraait Caddy in een eigen Docker-netwerk, zet de container dan in dat netwerk (zie commentaar in `docker-compose.yml`).Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathsscripts/backup.sh:2 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# Back-up van .env en het OAuth-volume naar een map op de NAS.Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Prompt injectionREADME.md:66 · Prompt injection — known jailbreak technique reference · informational: not an instruction file…le-ID (voor de Agenda) en het mailadres van iCloud Mail kunnen verschillen: zet dan het iCloud-adres in `ICLOUD_MAIL_ADDRESS`. `LOG_LEVEL` (standaard `INFO`) stelt…Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectiondocker-compose.yml:15 · Prompt injection — known jailbreak technique reference · informational: not an instruction file# Draait Caddy in een eigen Docker-netwerk? Haal dan de commentaartekens wegFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Access to sensitive file pathssetup.sh:9 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files# .env komt in de huidige map, met jouw eigen gebruiker als eigenaarFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssetup.sh:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--entrypoint icloud-mcp-setup icloud-mcp-setup --out /work/.env "$@"Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈33 tok
1 file · 23 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.