Macos Spm App Packaging

• Analyzed: May 14, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: cb5e79e0806ccec98d838df2f6f6a6386e238a3c038bc6d9dd1bf5905f5e46db
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its handling of sensitive credentials and execution of high-privilege security operations. Specifically, `assets/templates/setup_dev_signing.sh` directly modifies the user's keychain to install a code-signing identity, and `assets/templates/sign-and-notarize.sh` processes highly sensitive App Store Connect API keys for app notarization, temporarily writing the private key to disk. Additionally, `assets/templates/package_app.sh` and `assets/templates/make_appcast.sh` perform code signing and appcast signing, respectively, using provided identities or private keys, which are inherently high-risk operations, even if for their stated purpose of macOS app packaging.