ClawHub
Back to skill

Security audit

MetaRun: aso audit

Security checks for vulnerabilities and agentic risk

Overview

This ASO audit skill is a disclosed MetaRun integration with no bundled executable code, but users should be careful with the unpinned CLI and any MetaRun or Apple account credentials.

Install only if you intend to use MetaRun for ASO work. Use least-privilege MetaRun and Apple credentials, avoid running the unpinned `npx metarun` examples in highly privileged environments, and confirm before enabling background monitoring or any promotional scheduling/write operation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill explicitly references a personal access token and a local config file location used by npx metarun login, which normalizes handling of sensitive credentials in a broadly executable workflow. While merely documenting a token is not theft, this increases credential exposure risk if downstream tools, prompts, logs, or malicious package code access the environment or ~/.metarun/config.json.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md
envVars:
      - name: METARUN_TOKEN
        required: false
        description: MetaRun personal access token (Settings, MCP). Not needed after `npx metarun login`, which stores it in ~/.metarun/config.json.
    requires:
      anyBins:
        - npx

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs execution of npx metarun without a pinned package version, so the code fetched at runtime can change and may be replaced by a compromised or malicious release. In a skill context, this creates a supply-chain execution path because users or agents are directed to run whatever the registry serves at that moment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This line again directs use of unpinned npx metarun, which can download and execute unexpected code if the upstream package changes or the package ecosystem is compromised. Repeated unpinned tool execution increases exposure because operators may treat it as normal and run it in privileged environments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Using npx metarun without version pinning for schema/tool discovery still executes remote package code and is therefore part of the same supply-chain risk. Even read-only or discovery commands are dangerous when the executable itself is untrusted and mutable.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Lines L34-L37 state that the skill's mission only measures and diagnoses and that nothing here posts, publishes, or seeds content anywhere. However, lines L95-L97 advertise aso_schedule_promo_text, which is a content/publication-oriented capability and conflicts with that stated intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest description in L03-L08 scopes the skill to auditing discoverability, rankings, metadata linting, rival tracking, analytics, and AI-assistant visibility. The 'Beyond this mission' section adds aso_schedule_promo_text, which is a separate marketing execution capability not implied by the stated audit-focused purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The final discovery command also uses an unpinned npx invocation, preserving the same risk of arbitrary code execution through package substitution or compromise. Because it appears in a 'discover more' section, users may run it casually without applying extra scrutiny.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.