Apple Developer Toolkit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:45 PM UTC
• Version: 3.5.0

Overview

The skill’s purpose is coherent, but it asks users to install an unpinned external binary that can handle developer credentials and perform production App Store/release actions.

Install only if you trust the publisher and the mutable Homebrew tap. Prefer a pinned, checksum-verified release; use least-privilege App Store Connect API keys; avoid raw private keys in environment variables; and review hook configs, third-party integrations, and LLM data handling before using build or release automation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned External Binary Installed from a Personal Homebrew Tap<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14-24` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```json "install": [ { "id": "appledev", "kind": "brew", "tap": "Abdullah4AI/tap", "formula": "appledev", "bins": ["appledev"], "label": "Apple Developer Toolkit - unified binary (Homebrew)", }, ], ``` Related installation and credential-handling instructions appear in `SKILL.md:88-105`: ```bash brew install Abdullah4AI/tap/appledev appledev store auth login --name "MyApp" --key-id "KEY_ID" --issuer-id "ISSUER_ID" --private-key /path/to/AuthKey.p8 ``` The README also presents unpinned source and package installation workflows in `README.md:37-57`: ```bash brew install Abdullah4AI/tap/appledev ``` ```bash git clone https://github.com/Abdullah4AI/apple-developer-toolkit.git cd apple-developer-toolkit bash scripts/setup.sh ``` ```bash npx add-skill Abdullah4AI/apple-developer-toolkit ``` ### Technical Analysis The Skill instructs the host to install and execute an external `appledev` binary from a personal Homebrew tap. No immutable version, commit hash, binary checksum, or signature verification is specified. The repository artifact does not include the binary, the referenced `cli.js`, or `scripts/setup.sh`, so the executable implementation and source-installation behavior cannot be reviewed from the supplied package. This creates a supply-chain trust boundary: the code executed by users may change after the Skill itself has been audited. The risk is amplified because the binary is designed to receive or access sensitive App Store Connect credentials and an LLM API key. It also exposes commands that upload builds, manage signing assets, submit applications, and install build prerequisites. The finding does not establish that the current Homebrew formula or upstream repository is malicious. It establishes that the package relies on mutable, ...[truncated 1898 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the Homebrew formula and binary to an immutable release version rather than relying on a mutable latest release. 2. Publish SHA-256 checksums for every release artifact and verify them before installation or execution. 3. Sign release binaries and document signature verification using an independently verifiable signing identity. 4. Pin Git-based installation instructions to a reviewed commit hash or signed tag. 5. Avoid floating `npx` installation. Pin an exact package version and lock all transitive dependencies. 6. Include the executable source and referenced setup scripts in the audited artifact, or link to an immutable source revision that exactly matches the distributed binary. 7. Provide reproducible-build instructions so users can verify that published binaries correspond to reviewed source. 8. Document every action performed by `appledev build setup`, and require explicit confirmation before installing additional software. 9. Store App Store Connect private keys in the macOS Keychain or another protected credential store. Avoid raw private-key environment variables and command-line arguments. 10. Use a dedicated App Store Connect API key with the minimum role required for the requested operation, and rotate or revoke it if dependency compromise is suspected. 11. Separate documentation search, application generation, and App Store Connect administration into independently installable components so credential-free tasks do not require trusting a credential-capable binary. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Credential Access

High

• Category: Privilege Escalation

Content

notifiers:
  telegram:
    enabled: true
    bot_token_keychain: "my-bot-token"
    chat_id: "123456"

hooks:

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The README claims the toolkit can automatically wire up third-party backends like Supabase and RevenueCat, but those integrations are not declared in the manifest-level description. Undeclared external integrations increase the risk of hidden data flows, dependency introduction, and user surprise around authentication, storage, billing, or network communication.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README promotes automatic backend wiring and notification integrations without clearly warning that enabling these features may transmit source, metadata, credentials, or operational events to external services. In an agent skill context, unclear side effects are more dangerous because users may trust the skill to act locally while it provisions or connects remote services.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The README advertises lifecycle hooks, notifications, git tagging, and chained automation that materially expand the tool's operational scope beyond the stated three-tool description. That scope drift can mislead users and security reviewers about what the binary may do, increasing the risk of unexpected command execution, outbound notifications, or release automation in trusted environments.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The lifecycle hooks section describes auto-distribution, notifications, git tagging, and arbitrary chained operations, but does not foreground that these actions can change repositories, publish builds, or send data externally. In a build-and-release tool, silent or poorly disclosed automation can cause unintended deployment, data leakage, or destructive release actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill advertises AI-powered app generation and interactive chat backed by an external LLM API key, but does not disclose that prompts, source code, project structure, or build errors may be transmitted to a third-party AI provider. In a developer workflow, this can expose proprietary code, credentials embedded in project files, or sensitive business context without the user's informed consent.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill exposes commands that can upload builds, submit releases, modify metadata, trigger Xcode Cloud runs, and otherwise change App Store Connect state, but it does not clearly warn that these are write-capable operations affecting production-facing assets. A user could invoke these commands assuming they are informational and unintentionally alter release pipelines, store listings, or submission status.

Session Persistence

Medium

• Category: Rogue Agent

Content

SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array).
App Clips are a lightweight version of your app for quick, focused tasks.

INFO.PLIST (auto-configured on App Clip target in project.yml):
NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed.

ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array).
App Clips are a lightweight version of your app for quick, focused tasks.

INFO.PLIST (auto-configured on App Clip target in project.yml):
NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed.

ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

SETUP: Requires separate App Clip target (kind: "app_clip" in plan extensions array).
App Clips are a lightweight version of your app for quick, focused tasks.

INFO.PLIST (auto-configured on App Clip target in project.yml):
NSAppClip dict with NSAppClipRequestEphemeralUserNotification and NSAppClipRequestLocationConfirmation is set automatically. No manual configuration needed.

ASSOCIATED DOMAINS (auto-configured in project.yml entitlements):

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

SUPPORTED LANGUAGES: Check Translation.supportedLanguages for the device's available language pairs.
AVAILABILITY: Some language pairs require a model download on first use.
NO ENTITLEMENTS NEEDED: Translation framework requires no special entitlements or Info.plist keys.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

SUPPORTED LANGUAGES: Check Translation.supportedLanguages for the device's available language pairs.
AVAILABILITY: Some language pairs require a model download on first use.
NO ENTITLEMENTS NEEDED: Translation framework requires no special entitlements or Info.plist keys.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The document states 'System fonts only' and forbids custom or downloaded fonts as a blanket rule. This is a natural-language policy concern because it forces a specific presentation choice without offering user choice or documenting a narrow, region- or compliance-specific justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Line L16 states that code must only contain English string literals. This is a natural-language locale policy constraint that forces a specific language choice on authors without offering opt-in or explaining a justified region-specific requirement.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The rule explicitly recommends `SFSafariWebsiteAccess: { Level: All }`, which grants the extension access across all websites without any stated scoping, justification, or warning about the privacy and security implications. In a Safari extension context, broad page access increases the blast radius of any bug or misuse in content scripts or native messaging, enabling inspection or modification of data on arbitrary sites.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The file says persistence should be enabled when the user uses words like "save", "persist", "database", "storage", or "SwiftData". Several of these terms, especially "save" and "storage", are broad and could appear in casual requests without clearly indicating the user wants persistent on-disk data storage.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The instruction uses "if user says" followed by a short keyword list, but it does not clearly define boundaries or exclusions for when persistence should and should not be used. This can lead to inconsistent or unintended activation of SwiftData based on loose keyword matching rather than explicit user intent.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: This markdown guide includes a Location Services example that requests when-in-use authorization and processes location updates, but the surrounding documentation does not warn readers that the pattern involves collecting sensitive location data. For markdown files, user-affecting privacy behaviors should be disclosed so users understand the implications before adopting the example.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The Camera Access section demonstrates opening the device camera and capturing an image, but the markdown does not include any warning that this behavior invokes camera permission and handles user media. In markdown skill documentation, behaviors affecting privacy or user data should be explicitly disclosed.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The example explicitly applies `Locale(identifier: "de_DE")` and presents the resulting German-formatted output in a general-purpose guide. Under the language/locale policy, forcing a specific locale without user choice or clear region-specific justification can be a policy violation.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: This markdown file defines Siri invocation phrases, so vague-trigger checks apply. The phrase "Show note ..." is comparatively generic and the file does not provide scope limits, negative examples, or clarification about when Siri should route the request to this skill versus other note-related actions.

Intent-Code Divergence

Low

• Confidence: 98% confidence
• Finding: Earlier in the guide, the documentation explicitly says to convert enumerated sequences to arrays for use in `ForEach` and shows `Array(items.enumerated())` as the correct pattern (L106-L113). The checklist at L154 says "Don't convert enumerated sequences to arrays," which directly conflicts with the guide's own stated and demonstrated behavior.

Static analysis

No suspicious patterns detected.