ClawHub
Back to skill

Security audit

MetaRun: release handoff

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its App Store release purpose, but it asks agents to run an unpinned external CLI with release credentials and broad live tool discovery, so users should review it carefully before installing.

Install only if you trust MetaRun and are comfortable giving this skill App Store release authority. Prefer a pinned or preinstalled MetaRun client, use a narrowly scoped token where possible, review every preview diff, and avoid using this skill for pricing, reviews, ASO, or TestFlight unless you intentionally want that broader access.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The skill references a personal access token and a login flow that stores credentials in ~/.metarun/config.json, exposing a persistent credential target to any code the agent later runs. In combination with the unpinned npx execution pattern, this materially raises the risk of token theft and unauthorized App Store operations.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
envVars:
      - name: METARUN_TOKEN
        required: false
        description: MetaRun personal access token (Settings, MCP). Not needed after `npx metarun login`, which stores it in ~/.metarun/config.json.
    requires:
      anyBins:
        - npx

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Broad trigger phrases like 'ship it' or 'the build is up' can cause accidental invocation in normal conversation, especially in multi-skill environments. Because this skill can attach builds, change metadata, and submit apps for review, unintended activation could lead to consequential release operations being initiated or staged before the mistake is noticed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill repeatedly instructs the agent to execute npx metarun without pinning an exact package version. That allows the fetched code to change over time or be compromised upstream, turning routine release actions into arbitrary code execution in the agent environment with access to local files, credentials, and release authority.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using unpinned npx metarun to invoke tools means the behavior and code supply chain are uncontrolled at execution time. In a release-management skill, that can let a compromised or updated package manipulate App Store metadata, submissions, or local secrets unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The instruction to fetch live schemas via npx metarun tools still executes unpinned remote package code. Because this skill is designed for high-privilege release operations, any package compromise could alter tool discovery, exfiltrate data, or mislead the agent into unsafe follow-on actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Telling the agent to run npx metarun login if setup is missing introduces another unpinned package execution path during authentication. That is especially risky because login flows often handle tokens and write persistent config, creating an opportunity for credential theft or malicious persistence.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill directs the agent to search for additional tools using unpinned npx metarun tools, extending the same supply-chain execution risk into exploratory behavior. This broadens the attack surface because the agent may enumerate and later invoke more capabilities based on attacker-controlled package output.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly encourages exploring capabilities well beyond release handoff, such as pricing, ASO, reviews, and TestFlight. That scope expansion increases the chance an agent will perform sensitive but unintended actions under the authority of the same token, violating least privilege and making prompt-injection or operator error more damaging.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The final 'discover it live' instruction again relies on unpinned npx metarun, reinforcing an unsafe pattern of dynamic package execution in a privileged workflow. An attacker controlling the package or a dependency could steer the agent beyond intended actions or execute arbitrary code.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.