Harmonyos Flyverify Integretion

PassAudited by ClawScan on May 9, 2026.

Overview

This appears to be a coherent FlyVerify integration helper, but it will edit a HarmonyOS project, install third-party SDK packages, and handle MobTech app credentials.

Install this skill only if you want help integrating MobTech FlyVerify into a HarmonyOS project. Before approving actions, review the exact package-install commands, file diffs, added permissions, and any placement of appKey/appSecret values. Keep generated credential spreadsheets out of version control and test the app’s privacy-consent flow carefully.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If approved, the agent may change build settings, app permissions, and source code in the HarmonyOS project.

Why it was flagged

The skill is designed to perform file writes and project modifications, but the visible instruction requires showing the planned changes and waiting for user approval first.

Skill content

所有写文件和改文件操作前，都必须先展示计划修改内容并等待用户确认。

Recommendation

Review the proposed diff and commands before approving; keep the project under version control so changes can be reverted.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

MobTech credentials may be stored in a local Excel file or inserted into app code and could be exposed if the project is shared or committed carelessly.

Why it was flagged

The skill expects MobTech app credentials and uses them for SDK initialization. This is expected for the integration, but those values are sensitive project credentials.

Skill content

- 校验 `appKey`、`appSecret`、功能开关和超时
- 初始化：
  - `ZztSDK.init(context, appKey, appSecret)`

Recommendation

Use only the intended MobTech app credentials, keep generated credential files out of version control, and rotate credentials if they are accidentally exposed.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing these packages can change dependency files and bring external code into the app project.

Why it was flagged

The workflow installs third-party SDK packages without pinned versions. This is central to the integration, but it is still a supply-chain point users should review.

Skill content

- `ohpm install @zztsdk/zztcore`
  - `ohpm install @zztsdk/flyverify`

Recommendation

Verify the package names and publisher, review resulting dependency or lockfile changes, and pin versions where the project policy requires it.