App Packager

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:26 AM UTC
• Version: 1.0.0

Overview

This app-packaging skill is mostly purpose-aligned, but it can expose a user’s Pgyer API key in chat and mutates the local Git repo without enough guardrails.

Review before installing. Use this only in the intended local app repository, avoid providing API keys in chat unless the skill is fixed to mask them, and require a clean working tree plus explicit confirmation before branch switching, fetching, pulling, building, or uploading artifacts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:272

Finding

Plaintext API Key Disclosure in Build Feedback

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 272
Vulnerability Type: Sensitive credential exposure through user-visible output
Risk Level: High

Vulnerable Code:

bash

feedback+="• API_KEY：$api_key\n"

Technical Analysis

The skill accepts a user-provided Pgyer API key and passes it to the external packaging script. After a successful build, it appends the complete, unmasked key to the feedback message returned through reply.

Returning a credential is not required to confirm that an upload occurred. It unnecessarily expands the credential's exposure from the build process into chat history, agent logs, notification systems, monitoring infrastructure, shared transcripts, and any other system processing the response.

The API key is held in a shell variable and interpolated directly into the output without redaction. Although no hardcoded credential is present, this behavior discloses any credential supplied by the user.

Attack Path

1. A user provides a Pgyer API key as part of a packaging request.
2. The skill extracts the credential into the api_key variable.
3. The credential is passed to pgyer_all.sh as interactive input.
4. If the build completes successfully and uploading was requested, the skill interpolates the complete key into feedback.
5. The skill sends feedback through reply.
6. The exposed key may subsequently be recovered from conversation history, notifications, logs, telemetry, screenshots, or shared transcripts.
7. An unauthorized party can use the recovered key for operations permitted by the associated Pgyer account.

Impact Assessment

Successful exploitation exposes the complete Pgyer API credential. An attacker may gain the privileges granted to that key, potentially including unauthorized artifact uploads, modification or replacement of distributed application builds, access to upload-related account resources, or consumption of service qu ...[truncated 442 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the API key from all feedback and diagnostic messages. Report only that a user-provided credential was used.
2. If credential identification is operationally necessary, display only a minimally useful masked suffix, such as ****abcd, and never reveal the complete value.
3. Avoid accepting secrets through natural-language chat or command-line arguments, because both may be retained in history or process metadata.
4. Retrieve the key from a protected secret manager, operating-system keychain, or environment variable with appropriately restricted access.
5. Ensure pgyer_all.sh does not print the key to standard output, standard error, build logs, shell tracing, or network error messages.
6. Add output redaction before sending build results through reply, covering the supplied key and known credential formats.
7. Rotate any API key previously processed by this workflow if feedback messages may have been retained or shared.
8. Grant the upload key only the minimum Pgyer permissions required for artifact publication and use separate credentials for separate environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The success feedback explicitly includes API_KEY：$api_key in the reply message, causing a user-supplied secret to be echoed in plain text. This creates a direct secret disclosure risk through chat logs, agent telemetry, screenshots, or any downstream logging of assistant responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises automatic branch switching for packaging, but the description does not clearly warn that it may modify the local working copy and pull remote updates. In a developer environment, that can disrupt in-progress work, change build inputs unexpectedly, or apply unreviewed remote changes prior to execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises automatic branch switching for packaging, but the description does not clearly warn that it may modify the local working copy and pull remote updates. In a developer environment, that can disrupt in-progress work, change build inputs unexpectedly, or apply unreviewed remote changes prior to execution.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L019 instructs users that packaging must use the wrapper script and explicitly says not to manually execute pgyer_all.sh. But the documented implementation later pipes input directly into ./pgyer_all.sh, which contradicts the stated intent of avoiding direct execution. This is an active documentation-versus-behavior conflict, not merely an omission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description frames the action as app packaging and branch switching, but the workflow also performs git fetch --all and git pull origin "$branch", which changes the local repository state and imports remote code. This expands the operational scope beyond what a user may reasonably expect and can overwrite assumptions about the working copy, especially in automation contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The manifest description scopes the skill to branch switching, app packaging, build type, version, upload, API key, and release notes. The documentation also triggers on 渠道包, and the workflow maps that to a separate channel packaging mode, which is an additional specialized capability not mentioned in the manifest's stated scope. This is a capability expansion beyond the declared purpose details.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.