Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only PlayCover CLI guide whose powerful app-management commands are expected for its purpose, but users should treat uninstall, cleanup, config, download, and dylib operations carefully.
Install only if you are comfortable letting an agent advise on PlayCover CLI administration. Before running generated commands, verify bundle IDs and paths, back up app data/keymaps/settings before uninstall or reset operations, use trusted IPA and dylib sources, and be cautious with global config keys that suppress prompts or clear data during uninstall.
This is a markdown file, so SQP-2 applies to omissions in the skill description. The command reference lists operations that can remove apps, delete data, or alter configuration, but the document does not warn users that these actions may be destructive or irreversible.
The uninstall documentation states that app data, settings, entitlements, and related artifacts are removed by default, but it does not present this as a prominent destructive-action warning. In an AI-agent, CI, or shell-script context, users may invoke the command assuming a standard uninstall and unintentionally trigger irreversible data loss, especially because automation may not include an interactive confirmation step.
The markdown describes clear-cache as clearing an installed app's caches and clear-play-chain as clearing per-app state, but it does not warn that these actions remove app data and may affect app behavior or reset state. Because markdown files should disclose behaviors that can affect user data or system integrity, this omission is a safety concern.
The description states that prune will remove stale keymaps, settings, entitlements, containers, and PlayChain data, but it frames the command as 'safe to run periodically' without an explicit warning that files are being deleted. For markdown documentation, destructive cleanup behavior should be clearly disclosed so users understand the risk before running it automatically.
This markdown file documents settings set and settings reset, which can change app behavior and, for metalHUD, trigger a system-wide side effect. While the side effect is mentioned, there is no user-facing caution or warning section explaining the impact of modifying settings or resetting all settings to defaults.
This markdown file documents a command that writes global preferences shared across all apps, and the allowed keys include settings that suppress install/uninstall prompts and clear app data on uninstall. Under SQP-2 for markdown files, the description should warn users about behaviors that can affect user data or system integrity, but no such warning is provided.
This markdown file documents operations that copy a dynamic library into an app install and later remove it, which can affect app behavior and system integrity. The description provides usage and outputs but does not warn users that these actions modify installed apps and may cause instability or unintended side effects.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# `keymap` — manage keymaps
Per-app keyboard mapping management. A "keymap" is a `.playmap` (or legacy `.plist`) file mapping keyboard keys to touch coordinates and actions for an iOS app running under PlayCover.
The `keymap` command is a **group** with eight subcommands. `<bundleId>` identifies the app; `<name>` is the keymap's local name within that app.
This markdown file documents a reset operation that clears custom bindings, which can affect user data/state. Although the behavior is briefly described, it does not provide an explicit warning or caution about the destructive effect before use.
文件整体以中文编写并作为技能说明文档提供，但未说明这是可选语言版本、也未给出用户语言偏好或替代语言入口。根据规则，强制特定语言而无用户选择可能构成自然语言层面的语言/地区策略问题。
No suspicious patterns detected.