Security audit

Apple Developer Toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill’s purpose is coherent, but it asks users to install an unpinned external binary that can handle developer credentials and perform production App Store/release actions.

Install only if you trust the publisher and the mutable Homebrew tap. Prefer a pinned, checksum-verified release; use least-privilege App Store Connect API keys; avoid raw private keys in environment variables; and review hook configs, third-party integrations, and LLM data handling before using build or release automation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned External Binary Installed from a Personal Homebrew Tap
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 318)May include surrounding context.
md
notifiers: telegram: enabled: true bot_token_keychain: "my-bot-token" chat_id: "123456" hooks:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The README claims the toolkit can automatically wire up third-party backends like Supabase and RevenueCat, but those integrations are not declared in the manifest-level description. Undeclared external integrations increase the risk of hidden data flows, dependency introduction, and user surprise around authentication, storage, billing, or network communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes automatic backend wiring and notification integrations without clearly warning that enabling these features may transmit source, metadata, credentials, or operational events to external services. In an agent skill context, unclear side effects are more dangerous because users may trust the skill to act locally while it provisions or connects remote services.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises lifecycle hooks, notifications, git tagging, and chained automation that materially expand the tool's operational scope beyond the stated three-tool description. That scope drift can mislead users and security reviewers about what the binary may do, increasing the risk of unexpected command execution, outbound notifications, or release automation in trusted environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The lifecycle hooks section describes auto-distribution, notifications, git tagging, and arbitrary chained operations, but does not foreground that these actions can change repositories, publish builds, or send data externally. In a build-and-release tool, silent or poorly disclosed automation can cause unintended deployment, data leakage, or destructive release actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises AI-powered app generation and interactive chat backed by an external LLM API key, but does not disclose that prompts, source code, project structure, or build errors may be transmitted to a third-party AI provider. In a developer workflow, this can expose proprietary code, credentials embedded in project files, or sensitive business context without the user's informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill exposes commands that can upload builds, submit releases, modify metadata, trigger Xcode Cloud runs, and otherwise change App Store Connect state, but it does not clearly warn that these are write-capable operations affecting production-facing assets. A user could invoke these commands assuming they are informational and unintentionally alter release pipelines, store listings, or submission status.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/ios-rules/rules/app_clips.md (reported line 10)May include surrounding context.
md
SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array). App Clips are a lightweight version of your app for quick, focused tasks. INFO.PLIST (auto-configured on App Clip target in project.yml): NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed. ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/ios-rules/rules/safari_extension.md (reported line 27)May include surrounding context.
md
SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array). App Clips are a lightweight version of your app for quick, focused tasks. INFO.PLIST (auto-configured on App Clip target in project.yml): NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed. ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/ios-rules/rules/share_extension.md (reported line 37)May include surrounding context.
md
SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array). App Clips are a lightweight version of your app for quick, focused tasks. INFO.PLIST (auto-configured on App Clip target in project.yml): NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed. ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/ios-rules/rules/apple_translation.md (reported line 36)May include surrounding context.
md
SUPPORTED LANGUAGES: Check Translation.supportedLanguages for the device's available language pairs. AVAILABILITY: Some language pairs require a model download on first use. NO ENTITLEMENTS NEEDED: Translation framework requires no special entitlements or Info.plist keys.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skills/ios-rules/rules/share_extension.md (reported line 37)May include surrounding context.
md
SUPPORTED LANGUAGES: Check Translation.supportedLanguages for the device's available language pairs. AVAILABILITY: Some language pairs require a model download on first use. NO ENTITLEMENTS NEEDED: Translation framework requires no special entitlements or Info.plist keys.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The document states 'System fonts only' and forbids custom or downloaded fonts as a blanket rule. This is a natural-language policy concern because it forces a specific presentation choice without offering user choice or documenting a narrow, region- or compliance-specific justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L16 states that code must only contain English string literals. This is a natural-language locale policy constraint that forces a specific language choice on authors without offering opt-in or explaining a justified region-specific requirement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The rule explicitly recommends SFSafariWebsiteAccess: { Level: All }, which grants the extension access across all websites without any stated scoping, justification, or warning about the privacy and security implications. In a Safari extension context, broad page access increases the blast radius of any bug or misuse in content scripts or native messaging, enabling inspection or modification of data on arbitrary sites.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file says persistence should be enabled when the user uses words like "save", "persist", "database", "storage", or "SwiftData". Several of these terms, especially "save" and "storage", are broad and could appear in casual requests without clearly indicating the user wants persistent on-disk data storage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The instruction uses "if user says" followed by a short keyword list, but it does not clearly define boundaries or exclusions for when persistence should and should not be used. This can lead to inconsistent or unintended activation of SwiftData based on loose keyword matching rather than explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown guide includes a Location Services example that requests when-in-use authorization and processes location updates, but the surrounding documentation does not warn readers that the pattern involves collecting sensitive location data. For markdown files, user-affecting privacy behaviors should be disclosed so users understand the implications before adopting the example.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The Camera Access section demonstrates opening the device camera and capturing an image, but the markdown does not include any warning that this behavior invokes camera permission and handles user media. In markdown skill documentation, behaviors affecting privacy or user data should be explicitly disclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example explicitly applies Locale(identifier: "de_DE") and presents the resulting German-formatted output in a general-purpose guide. Under the language/locale policy, forcing a specific locale without user choice or clear region-specific justification can be a policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file defines Siri invocation phrases, so vague-trigger checks apply. The phrase "Show note ..." is comparatively generic and the file does not provide scope limits, negative examples, or clarification about when Siri should route the request to this skill versus other note-related actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Earlier in the guide, the documentation explicitly says to convert enumerated sequences to arrays for use in ForEach and shows Array(items.enumerated()) as the correct pattern (L106-L113). The checklist at L154 says "Don't convert enumerated sequences to arrays," which directly conflicts with the guide's own stated and demonstrated behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.