Security audit

aso

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only ASO audit skill that uses public app-store data and optional local marketing context without installing code, persisting changes, or handling credentials.

Install this skill if you are comfortable with an agent visiting App Store or Google Play pages, searching for app listings or competitors, taking listing screenshots, and reading local product-marketing context files when present. Review any recommendations before applying them in store consoles, because the skill advises marketing changes but does not itself make account changes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
### Tier definitions | Tier | Signals | Examples | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------- | | **Dominant** | Household name, 1M+ ratings, top-10 in category, near-universal brand recognition. Users search by brand name, not generic keywords. | Instagram, Uber, Spotify, WhatsApp, Netflix | | **Established** | Well-known in their category, 100K+ ratings, strong organic installs, recognized brand but not universally known. | Strava, Notion, Duolingo, Cash App, Calm |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 41)May include surrounding context.
md
**Challenger rubric:** | Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 44)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 47)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 108)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 45)May include surrounding context.
md
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 181)May include surrounding context.
md
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 46)May include surrounding context.
md
| 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 48)May include surrounding context.
md
| 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) | **Dominant/Established adjustment:** Brand-only titles (e.g., "Instagram") are valid if the brand has high search volume. Score 8+ for Dominant apps where

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 70)May include surrounding context.
md
### Apple App Store | Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 73)May include surrounding context.
md
| Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 75)May include surrounding context.
md
| Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 76)May include surrounding context.
md
| 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort | | 0 | Cannot assess | ### Google Play

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 77)May include surrounding context.
md
| 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort | | 0 | Cannot assess | ### Google Play

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 81)May include surrounding context.
md
### Google Play | Score | Criteria | | ----- | -------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Keywords in first 3 sentences, 2-3% natural density throughout, HTML formatting used, structured sections, strong CTA, keywords feel natural | | 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 86)May include surrounding context.
md
| 9-10 | Keywords in first 3 sentences, 2-3% natural density throughout, HTML formatting used, structured sections, strong CTA, keywords feel natural | | 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 87)May include surrounding context.
md
| 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 129)May include surrounding context.
md
| 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 88)May include surrounding context.
md
| 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 104)May include surrounding context.
md
## 3. Visual Assets (Weight: 25%) | Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | 8-10 screenshots with clear messaging/captions, preview video present, screenshots tell a story in sequence, each communicates one benefit, icon is distinctive and memorable | | 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 109)May include surrounding context.
md
| 9-10 | 8-10 screenshots with clear messaging/captions, preview video present, screenshots tell a story in sequence, each communicates one benefit, icon is distinctive and memorable | | 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear | | 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 110)May include surrounding context.
md
| 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear | | 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 111)May include surrounding context.
md
| 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 152)May include surrounding context.
md
## 5. Metadata & Freshness (Weight: 10%) | Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Updated within last month, 10+ localizations, optimal category choice, in-app events/LiveOps active, data safety complete | | 7-8 | Updated within 2 months, 5+ localizations, good category, data safety present |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 159)May include surrounding context.
md
| 5-6 | Updated within 3 months, 2-4 localizations, acceptable category | | 3-4 | Updated 3-6 months ago, 1-2 localizations, possibly wrong category | | 1-2 | Not updated in 6+ months, single language, poor category choice | | 0 | Cannot assess | **Check for:**

Static analysis

No suspicious patterns detected.