MetaRun: localize listing

• Outcome: Pass
• Latest audit: Oct 7, 2026 · 11:57 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent MetaRun helper for translating and applying App Store listing text, with disclosed credential use and user confirmation before writes.

Install this only if you intend to let MetaRun read and update your App Store listing metadata. Review generated translations and previews carefully before confirming applies, be especially careful with promotional text because it can publish immediately, and consider using a pinned or preinstalled MetaRun CLI rather than running the latest package through npx.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill explicitly references a personal access token and notes that login stores credentials in ~/.metarun/config.json, establishing that sensitive credentials may be present on disk or in environment variables during execution. Any compromise of the invoked tooling, local prompt injection into file-reading tools, or overbroad agent behavior could expose or misuse those credentials to modify app listings.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

envVars:
      - name: METARUN_TOKEN
        required: false
        description: MetaRun personal access token (Settings, MCP). Not needed after `npx metarun login`, which stores it in ~/.metarun/config.json.
    requires:
      anyBins:
        - npx

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

name, subtitle, description, keywords, What's New, promotional text, and
  URLs, per locale. YOU do the translating; MetaRun stages and applies.
  Trigger phrases: "translate my listing", "localize the app store page",
  "add German", "update the description in every language", "write What's
  New and translate it".
metadata:
  openclaw:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The skill instructs the agent to invoke npx metarun without pinning a package version, which makes execution depend on whatever package version is current at runtime. If the upstream package is compromised or a breaking/malicious version is published, the agent could execute untrusted code with access to local files, tokens, or the MetaRun session.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This line again directs use of unpinned npx metarun, creating a supply-chain execution risk. Because this skill operates on publishing metadata and may run in environments with stored credentials, an unexpected package update could abuse that access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Fetching tool schemas via an unpinned npx package still requires executing code from the registry at the latest available version. That exposes the agent to package substitution or malicious update risk before any schema is even read.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The discovery instruction uses npx metarun tools studio without version pinning, repeating the same supply-chain risk path. In a skill ecosystem, repeated unpinned execution increases exposure because users may run multiple commands over time with changing code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.