iOS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:58 PM UTC
• Version: 1.0.2

Overview

The skill is coherent iOS guidance and does not show remote exfiltration, but it automatically reads and writes persistent local project, device, client, and finance notes without clear opt-in.

Install only if you are comfortable with this skill keeping local memory about iOS apps and writing shared device, client, project, and subscription records. Review or restrict its access to ~/Clawic/data, and require explicit confirmation before any legacy-directory migration or shared-record update.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:39
• Finding: Automatic Cross-Domain Collection and Persistence Exceeds Least Privilege## Vulnerability Details **File Location**: `SKILL.md:39-45`; supporting storage rules in `memory-template.md:3-43` and `memory-template.md:204-276` **Vulnerability Type**: Excessive automatic access to persistent and shared user data **Risk Level**: Medium ### Vulnerable Code ```markdown **Data.** At the start of every session, read `~/Clawic/data/ios/config.yaml` (what the user declared) and `~/Clawic/data/ios/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). An observation never overwrites a declaration: where the two disagree, `config.yaml` wins and the observation is recorded next to it, until the user says otherwise. Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/devices/devices.md` before anything device-specific: a repro, a UDID question, a "why only on that phone". If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: an app, bundle id, capability or identifier discovered or changed; a test device added, upgraded or retired; a release shipped and its build number; an SDK added, updated or removed; a review rejection and the exact change that cleared it; a measured baseline (cold launch, download size, crash-free rate, hang rate); a platform fact that cost effort to find; or something the user will re-read — a runbook, an entitl ...[truncated 3646 chars]
• Remediation: ## Remediation Suggestions 1. Make persistent memory disabled by default and require explicit user opt-in. 2. Request confirmation before reading or modifying shared device, contact, finance, profile, or project stores. 3. Restrict default access to `~/Clawic/data/ios/`; grant access to another domain only when the active task specifically requires it. 4. Present the exact destination, fields, purpose, and retention period before writing. 5. Minimize stored data—for example, avoid full UDIDs, email addresses, financial amounts, and client metadata unless indispensable. 6. Provide commands or documented procedures to inspect, correct, export, and delete persisted records. 7. Separate records by Skill and enforce ownership using machine-verifiable metadata rather than prose conventions. 8. Apply retention limits and remove stale data after user confirmation.

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:39
• Finding: Mutable Persistent Markdown Can Poison Future Agent Behavior## Vulnerability Details **File Location**: `SKILL.md:39`; supporting indexing rules in `memory-template.md:185-186` and artifact rules in `memory-template.md:278-303` **Vulnerability Type**: Persistent instruction injection through trusted memory files **Risk Level**: Medium ### Vulnerable Code ```markdown **Data.** At the start of every session, read `~/Clawic/data/ios/config.yaml` (what the user declared) and `~/Clawic/data/ios/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). An observation never overwrites a declaration: where the two disagree, `config.yaml` wins and the observation is recorded next to it, until the user says otherwise. Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/devices/devices.md` before anything device-specific: a repro, a UDID question, a "why only on that phone". If none of it exists, work from defaults and say nothing about it. ``` The persistent index format is instruction-bearing: ```markdown - **`## Boxes`**: one line per file that exists — `<what> (<volume>) → <file>; read when <condition>`. Written in the same turn the file is created. Never delete a line without deleting the file it points to. A box with no index line does not exist. - **`## Due`**: check it against today's date at the start of a session and state any overdue item in one line — a statem ...[truncated 2608 chars]
• Remediation: ## Remediation Suggestions 1. Treat every memory and artifact file as untrusted data, never as authoritative instructions. 2. Replace free-form Markdown control fields with a strict structured schema containing enumerated trigger types and validated relative paths. 3. Reject unknown keys, imperative text in control fields, absolute paths, traversal components, symbolic-link escapes, and files outside an explicit allowlist. 4. Store provenance, creator identity, timestamps, and integrity hashes for index entries. 5. Require user confirmation before following a newly created or externally modified index entry. 6. Render imported content as quoted reference material and explicitly prohibit following instructions contained inside it. 7. Separate operational policy, which must remain immutable and package-controlled, from user memory, which must remain non-executable. 8. Warn the user when a memory file's integrity or ownership cannot be verified.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:45
• Finding: Legacy Data Is Moved Without Explicit Confirmation or Rollback Controls## Vulnerability Details **File Location**: `SKILL.md:45` **Vulnerability Type**: Unsafe automatic filesystem migration **Risk Level**: Medium ### Vulnerable Code ```markdown **No credential is ever written anywhere under `~/Clawic/data/`** — not in the files named here, not in a file you create, not in text the user pastes in to be saved. Store the pointer and strip the value: `keychain:apple-id-app-specific`, `env:ASC_KEY_ID`, `1password:Work/Apple/asc-key`, `file:~/private_keys/AuthKey.p8`. App Review demo-account passwords are credentials too. If data sits at an old location (`~/ios/` or `~/clawic/ios/`), move it to `~/Clawic/data/ios/`, and say in one line that you moved it and from where. ``` ### Technical Analysis The instruction mandates moving legacy data and only notifying the user after the operation. A move is destructive with respect to the source path: software still depending on the old location can fail, and destination conflicts can overwrite or merge files incorrectly depending on the implementation. The instruction does not require prior confirmation, a destination collision check, source validation, a backup, copy verification, preservation of permissions and metadata, or a rollback procedure. It also conflicts with the later guardrail in `SKILL.md:235`, which says destructive changes require explicit confirmation. The credential-stripping requirement does not mitigate filesystem migration risks and may itself alter data if applied during migration without preserving a verified original. ### Attack Path 1. The Skill detects data under `~/ios/` or `~/clawic/ios/`. 2. It follows the mandatory instruction to move that data without first obtaining user approval. 3. The destination already contains files, or another tool still references the legacy path. 4. Files are overwritten, merged incorrectly, or removed from the location expected by existing tooling. 5. The user is informed only after the mutation h ...[truncated 722 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit confirmation before any migration that removes or changes the source. 2. Show the exact source, destination, planned file list, conflicts, and expected effects before proceeding. 3. Copy data to a staging directory rather than moving it directly. 4. Validate file counts, hashes, permissions, ownership, and destination contents after copying. 5. Preserve the original directory as a timestamped backup until the user confirms the migration succeeded. 6. Refuse to overwrite destination files automatically; require a per-conflict decision or use a non-destructive merge plan. 7. Record a migration journal and provide a tested rollback procedure. 8. If compatibility is needed, offer a user-approved symbolic link only after validating that it cannot escape the allowed directories. 9. Harmonize this instruction with the explicit-confirmation guardrail for destructive operations.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (48)

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

A hang is the main thread blocked ≥250 ms. The usual culprits, in order of frequency:

- Synchronous file or keychain access on the main thread. Keychain calls are surprisingly slow and are usually made during launch.
- JSON decoding, image decoding, or a large `Codable` round-trip on the main thread.
- A Core Data fetch on the view context with a predicate that cannot use an index, or a fetch that faults thousands of objects.
- Layout thrash: a synchronous layout pass inside a scroll callback, or a SwiftUI view whose body does real work.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill requests routine access to shared contacts and finances data stores even though its primary role is iOS app debugging. This broadens data exposure beyond least-privilege and could let the skill read or modify sensitive personal/business records unrelated to the current task, especially because it is instructed to persist session artifacts across shared files.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Data.** At the start of every session, read `~/Clawic/data/ios/config.yaml` (what the user declared) and `~/Clawic/data/ios/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). An observation never overwrites a declaration: where the two disagree, `config.yaml` wins and the observation is recorded next to it, until the user says otherwise. Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/devices/devices.md` before anything device-specific: a repro, a UDID question, a "why only on that phone". If none of it exists, work from defaults and say nothing about it.

**Write before the session ends** whenever it produced something durable: an app, bundle id, capability or identifier discovered or changed; a test device added, upgraded or retired; a release shipped and its build number; an SDK added, updated or removed; a review rejection and the exact change that cleared it; a measured baseline (cold launch, download size, crash-free rate, hang rate); a platform fact that cost effort to find; or something the user will re-read — a runbook, an entitlements or Info.plist set that finally worked, a persistence or paywall decision, review notes. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.

**Test devices go to the shared inventory `~/Clawic/data/devices/devices.md`**, not here: one fil
...[truncated 25 chars]

• Confidence: 94% confidence
• Finding: The skill mandates automatic reading and writing of persistent session memory across multiple local files, including shared inventories and project records. Even if data stays local, this creates privacy and integrity risk because durable notes about apps, devices, clients, releases, and observations are retained by default and may accumulate sensitive metadata outside the immediate user request.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to persist app identifiers, entitlements, team IDs, and troubleshooting artifacts into local files under a user home directory. That creates cross-session retention of potentially sensitive customer/project metadata that is not strictly necessary to answer an iOS troubleshooting question, increasing the risk of unintended data accumulation, later disclosure, or use in unrelated tasks.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Write It Down

- **An identifier or entitlement discovered by inspecting a build** — the real `aps-environment`, an App Group that is not what the project claimed, a team id — updates that app's row in `## Apps` in `~/Clawic/data/ios/memory.md` (`memory-template.md`). Finding it twice is pure waste.
- **A command sequence that took real work to assemble** — an export options plist, a device log predicate that isolates the bug, a repeatable repro script — is `artifacts/<kebab-name>.md`, with its `## Boxes` line in the same turn.

• Confidence: 94% confidence
• Finding: This line directs the agent to save assembled command sequences, repro scripts, and log predicates into persistent artifact files. That is genuine session persistence and can retain sensitive operational details, app structure, identifiers, or environment-specific debugging information beyond the immediate task.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

## What Every Extension Shares

- **A separate process, a separate target, a separate Info.plist and a separate entitlements file.** Nothing is inherited from the app. An App Group, a keychain group or a push capability added to the app alone does not exist here (`capabilities.md`).
- **A memory ceiling far below the app's**, undocumented and different per extension point. The rule is to keep peak footprint small and measure; if an extension "crashes with no crash log", assume memory first.
- **A short, host-controlled lifetime.** The host app can dismiss the extension at any moment. Work that must finish moves to a background `URLSession` owned by the shared container, not to a longer spinner (`background.md`).
- **No `UIApplication.shared`.** The API is unavailable in extensions, which rules out opening URLs, reading application state, or taking background task assertions the app way.

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: memory-template.md:66