icloud-calendar

SUSPICIOUS: the skill’s purpose is coherent, but it relies on a bundled, unverifiable CLI that appears to receive Apple account credentials through its own local setup flow. That makes the main risk supply-chain trust and credential forwarding to opaque third-party code rather than overtly malicious behavior.