eventkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited eventkit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use EventKit for calendar and reminder authorization, CRUD, recurrence, alarms, and system editors.
requestAccess(to:) no longer prompts and throws. The system event editor can create an event without app calendar access. For iOS 10–16, guard those APIs, use the legacy request plus NSCalendarsUsageDescription / NSRemindersUsageDescription; EventKitUI may also need NSContactsUsageDescription.
EKEventStore.EventStoreChanged / .changed message isavailable behind a guard. Keep EKEventStoreChanged for earlier systems.
Add the usage description for the access path selected in Authorization. Do not request broader access merely to simplify the setup path.
The authorization-free system editor path needs no calendar usage string. Direct writes need write-only or full access; reads need full access. Reminders have only full access.
Create a single EKEventStore instance and reuse it. Do not mix objects from different event stores.
import EventKit
let eventStore = EKEventStore()Request the narrowest access that matches the feature. Apply the versioned request path in Availability.
| Key | Access Level |
|---|---|
NSCalendarsFullAccessUsageDescription | Read + write events |
NSCalendarsWriteOnlyAccessUsageDescription | Direct write-only event creation |
NSRemindersFullAccessUsageDescription | Read + write reminders |
Call try await eventStore.requestFullAccessToEvents() when the app needs to read, edit, delete, or fetch calendar events.
Use when your app only creates events (e.g., saving a booking) and does not need to read existing events.
Call try await eventStore.requestWriteOnlyAccessToEvents() before direct EventKit writes that do not use EKEventEditViewController.
Write-only access can create events but cannot fetch calendars or events, including app-created events. Use full access for later query, verification, modification, or sync.
Call try await eventStore.requestFullAccessToReminders() before reading, creating, editing, or deleting reminders.
Use EKEventStore.authorizationStatus(for: .event) or .reminder before work. Handle .notDetermined, .fullAccess, .writeOnly, .restricted, .denied, and @unknown default; only .fullAccess supports event/reminder reads.
func createEvent(
title: String,
startDate: Date,
endDate: Date,
calendar: EKCalendar? = nil
) throws {
let event = EKEvent(eventStore: eventStore)
event.title = title
event.startDate = startDate
event.endDate = endDate
event.calendar = calendar ?? eventStore.defaultCalendarForNewEvents
try eventStore.save(event, span: .thisEvent)
}// List writable calendars
let calendars = eventStore.calendars(for: .event)
.filter { $0.allowsContentModifications }
// Use the first writable calendar, or the default
let targetCalendar = calendars.first ?? eventStore.defaultCalendarForNewEvents
event.calendar = targetCalendarimport CoreLocation
let location = EKStructuredLocation(title: "Apple Park")
location.geoLocation = CLLocation(latitude: 37.3349, longitude: -122.0090)
event.structuredLocation = locationAfter the full-access gate in Authorization, use a date-range predicate to query events. The events(matching:) method returns occurrences of recurring events expanded within the range. Event predicates are capped to a four-year span, and events(matching:) / enumerateEvents(matching:using:) are synchronous and return only committed events.
func fetchEvents(from start: Date, to end: Date) -> [EKEvent] {
let predicate = eventStore.predicateForEvents(
withStart: start,
end: end,
calendars: nil // nil = all calendars
)
return eventStore.events(matching: predicate)
.sorted { $0.startDate < $1.startDate }
}if let event = eventStore.event(withIdentifier: savedEventID) {
print(event.title ?? "No title")
}func createReminder(title: String, dueDate: Date) throws {
let reminder = EKReminder(eventStore: eventStore)
reminder.title = title
reminder.calendar = eventStore.defaultCalendarForNewReminders()
let dueDateComponents = Calendar.current.dateComponents(
[.year, .month, .day, .hour, .minute],
from: dueDate
)
reminder.dueDateComponents = dueDateComponents
try eventStore.save(reminder, commit: true)
}Reminder fetches are asynchronous and return through a completion handler.
func fetchIncompleteReminders() async -> [EKReminder] {
let predicate = eventStore.predicateForIncompleteReminders(
withDueDateStarting: nil,
ending: nil,
calendars: nil
)
return await withCheckedContinuation { continuation in
eventStore.fetchReminders(matching: predicate) { reminders in
continuation.resume(returning: reminders ?? [])
}
}
}func completeReminder(_ reminder: EKReminder) throws {
reminder.isCompleted = true
try eventStore.save(reminder, commit: true)
}Use EKRecurrenceRule to create repeating events or reminders.
// Every week, indefinitely
let weeklyRule = EKRecurrenceRule(
recurrenceWith: .weekly,
interval: 1,
end: nil
)
event.addRecurrenceRule(weeklyRule)
// Every 2 weeks, ending after 10 occurrences
let biweeklyRule = EKRecurrenceRule(
recurrenceWith: .weekly,
interval: 2,
end: EKRecurrenceEnd(occurrenceCount: 10)
)
// Monthly, ending on a specific date
let monthlyRule = EKRecurrenceRule(
recurrenceWith: .monthly,
interval: 1,
end: EKRecurrenceEnd(end: endDate)
)// Every Monday and Wednesday
let days = [
EKRecurrenceDayOfWeek(.monday),
EKRecurrenceDayOfWeek(.wednesday)
]
let complexRule = EKRecurrenceRule(
recurrenceWith: .weekly,
interval: 1,
daysOfTheWeek: days,
daysOfTheMonth: nil,
monthsOfTheYear: nil,
weeksOfTheYear: nil,
daysOfTheYear: nil,
setPositions: nil,
end: nil
)
event.addRecurrenceRule(complexRule)When saving changes to a recurring event, specify the span:
// Change only this occurrence
try eventStore.save(event, span: .thisEvent)
// Change this and all future occurrences
try eventStore.save(event, span: .futureEvents)Attach alarms to events or reminders to trigger notifications.
// 15 minutes before
let alarm = EKAlarm(relativeOffset: -15 * 60)
event.addAlarm(alarm)
// At an absolute date
let absoluteAlarm = EKAlarm(absoluteDate: alertDate)
event.addAlarm(absoluteAlarm)For reminder geofences, put an EKStructuredLocation and .enter / .leave proximity on an EKAlarm, then add it to the reminder. See references/eventkit-patterns.md for the full location-based reminder pattern.
Present the system event editor for creating or editing events.
On the authorization-free path in Availability, the editor runs out of process with its own calendar access. Do not inspect the dismissed controller to learn what was saved; refetch only with separate full access.
import EventKitUI
class EventEditorCoordinator: NSObject, EKEventEditViewDelegate {
let eventStore = EKEventStore()
func presentEditor(from viewController: UIViewController) {
let editor = EKEventEditViewController()
editor.eventStore = eventStore
editor.editViewDelegate = self
viewController.present(editor, animated: true)
}
func eventEditViewController(
_ controller: EKEventEditViewController,
didCompleteWith action: EKEventEditViewAction
) {
switch action {
case .saved:
// Event saved
break
case .canceled:
break
case .deleted:
break
@unknown default:
break
}
controller.dismiss(animated: true)
}
}import EventKitUI
let viewer = EKEventViewController()
viewer.event = existingEvent
viewer.allowsEditing = true
navigationController?.pushViewController(viewer, animated: true)EKCalendarChooser requires write-only or full calendar access. In write-only apps, the chooser behaves as writable-calendars-only and only allows a single writable calendar selection.
let chooser = EKCalendarChooser(
selectionStyle: .multiple,
displayStyle: .allCalendars,
entityType: .event,
eventStore: eventStore
)
chooser.showsDoneButton = true
chooser.showsCancelButton = true
chooser.delegate = self
present(UINavigationController(rootViewController: chooser), animated: true)Register for EKEventStoreChanged notifications to keep your UI in sync when events are modified outside your app (e.g., by the Calendar app or a sync).
NotificationCenter.default.addObserver(
forName: .EKEventStoreChanged,
object: eventStore,
queue: .main
) { [weak self] _ in
self?.refreshEvents()
}Always re-fetch events after receiving this notification. Previously fetched EKEvent, EKReminder, and EKCalendar objects may be stale. The notification is posted on the main actor.
// WRONG: Legacy request API on current systems
eventStore.requestAccess(to: .event) { granted, error in }
// CORRECT: Use the granular async methods
let granted = try await eventStore.requestFullAccessToEvents()Keep it only in the compatibility fallback from Availability.
// WRONG: No check -- will throw if calendar is read-only
event.calendar = someCalendar
try eventStore.save(event, span: .thisEvent)
// CORRECT: Verify the calendar allows modifications
guard someCalendar.allowsContentModifications else {
event.calendar = eventStore.defaultCalendarForNewEvents
return
}
event.calendar = someCalendar
try eventStore.save(event, span: .thisEvent)// WRONG: Event appears at wrong time for traveling users
event.startDate = Date()
event.endDate = Date().addingTimeInterval(3600)
// CORRECT: Set the timezone explicitly for location-specific events
event.timeZone = TimeZone(identifier: "America/New_York")
event.startDate = startDate
event.endDate = endDate// WRONG: Changes never persisted
try eventStore.save(event1, span: .thisEvent, commit: false)
try eventStore.save(event2, span: .thisEvent, commit: false)
// Missing commit!
// CORRECT: Commit after batching
try eventStore.save(event1, span: .thisEvent, commit: false)
try eventStore.save(event2, span: .thisEvent, commit: false)
try eventStore.commit()// WRONG: Event fetched from storeA, saved to storeB
let event = storeA.event(withIdentifier: id)!
try storeB.save(event, span: .thisEvent) // Undefined behavior
// CORRECT: Use the same store throughout
let event = eventStore.event(withIdentifier: id)!
try eventStore.save(event, span: .thisEvent)Info.plist usage description keys added for calendars and/or remindersEKEventStore instance reused across the appallowsContentModifications checked)EKSpan (.thisEvent vs .futureEvents)commit: false,call throwing commit(), and on failure reset() unsaved state, discard every invalidated EKObject, then refetch or reconstruct before retry
EKEventStoreChanged notification observed to refresh stale data~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.