icloud-mcp: why it is not safe to use
We found powerful account and local message access with destructive actions, but no built-in confirmation step for high-impact tools.
What we found
Our review did not find hidden instructions, hardcoded secrets, obfuscated code, vendor telemetry, or remote code download. The repository appears to send data only to the connected AI client and to Apple service endpoints the user configures.
The main concern is scope and safeguards. This skill exposes several high-impact actions, including `send-email`, `send-message`, `react-message`, `delete-event`, `delete-contact`, `delete-reminder`, and `close-safari-tab`. These are labeled as destructive in the repo, but we did not find an enforced confirmation step in the skill itself before those actions run.
We also found sensitive data access paths. In cloud mode, the skill reads `ICLOUD_EMAIL` and `ICLOUD_APP_PASSWORD` from environment variables. For local message reading, it relies on Full Disk Access to the Messages database through `imsg`, which can expose private communications.
What to do instead
Use this skill only if you want an AI client to access iCloud data and local Messages content with that level of authority. Prefer a setup that adds user confirmation for send, delete, and reaction tools, limits which tools are enabled, and uses a dedicated app password stored with your normal secret-management process. If you do not need local Messages access, avoid granting Full Disk Access.
Source: https://github.com/MrGo2/icloud-mcp
We report what our security review found at the time we checked, with the goal of keeping people safe. Projects change; if a maintainer has since fixed this, we are glad to recheck it. Email hello@agentpod.com.