TestFlight

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A mistaken or unauthorized run could send a beta build to testers or submit it to Apple beta review.

Why it was flagged

This documented lane can submit a build for beta review and distribute it to external testers. That is purpose-aligned for TestFlight automation, but it is a high-impact account action.

Skill content

upload_to_testflight(
    api_key_path: "fastlane/api_key.json",
    distribute_external: true,
    groups: ["Beta Testers"],
    submit_beta_review: true
  )

Recommendation

Keep external distribution lanes manual or approval-gated, verify tester groups before running, and avoid letting CI triggers deploy unexpectedly.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone with these secrets could potentially upload builds or modify TestFlight-related app state for the associated Apple developer account.

Why it was flagged

The workflow requires an App Store Connect API private key with App Manager authority. This is expected for TestFlight automation, but it grants sensitive account-level release permissions.

Skill content

Role: "App Manager" (minimum for TestFlight)
...
APPSTORE_API_KEY_CONTENT="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"

Recommendation

Use least-privilege Apple credentials where possible, store .p8/P12 material only in CI secrets or Keychain, never commit api_key.json or certificate files, and rotate keys if exposed.