Apple App Store API - App Search, Listing Detail, Reviews

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:11 AM UTC
• Version: 1.0.4

Overview

This skill is a straightforward App Store lookup helper that uses a disclosed Scavio API key and external API calls, with an optional SDK install that users should treat like any third-party dependency.

Install only if you are comfortable sending App Store query terms, app identifiers, and your Scavio API key to Scavio. Prefer the direct HTTPS examples or install the SDK in an isolated environment, use a revocable API key, and monitor credit usage because API calls consume credits.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:215

Finding

Third-Party SDK Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 215-226
Vulnerability Type: Third-party dependency and software supply-chain risk
Risk Level: Medium

The Skill recommends installing and executing third-party Python and JavaScript SDKs:

bash

pip install scavio==0.15.0

python

from scavio import ScavioClient

client = ScavioClient()  # reads SCAVIO_API_KEY

bash

npm install scavio@0.15.0

js

import { Scavio } from "scavio";

const scavio = new Scavio(); // reads SCAVIO_API_KEY

Technical Analysis

Pinning both packages to version 0.15.0 limits unexpected version drift, but the instructions provide no cryptographic hashes, signed lockfiles, package provenance checks, or verified registry references. Package installation and subsequent import execute code supplied by an external package registry and package publisher.

Both SDKs are explicitly expected to read the SCAVIO_API_KEY environment variable. Consequently, a compromised package release, registry account, distribution channel, or dependency in either SDK could access that credential. Installation-time scripts or imported runtime code could also access other files, environment variables, network resources, and permissions available to the invoking user.

This is a conditional supply-chain risk rather than evidence that either named package is currently malicious. The direct HTTPS examples documented elsewhere in the Skill provide a lower-dependency alternative for the declared App Store query functionality.

Attack Path

1. An attacker compromises the publisher account, package artifact, registry delivery path, or transitive dependency associated with the recommended SDK.
2. A user or agent follows the Skill instructions and runs pip install scavio==0.15.0 or npm install scavio@0.15.0.
3. Package-controlled installation or build behavior executes with the privileges of the invoking process, wh ...[truncated 1142 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer the documented direct HTTPS requests where an SDK is not necessary, reducing the number of trusted third-party components.
2. Provide authoritative package registry links and publisher identity information so users can verify that they are installing the intended packages.
3. Supply lockfiles containing resolved transitive dependencies and integrity metadata for reproducible installations.
4. For Python, publish and verify package hashes and recommend hash-enforced installation, such as pip install --require-hashes -r requirements.txt.
5. For JavaScript, provide a reviewed lockfile and recommend deterministic installation with npm ci; verify registry integrity metadata before execution.
6. Review the packages and their transitive dependency trees for installation scripts, unexpected network activity, and unnecessary filesystem or environment access.
7. Install and run the SDK in an isolated virtual environment or container under a non-privileged account.
8. Expose only SCAVIO_API_KEY to the process when required, rather than inheriting an environment containing unrelated credentials.
9. Use a narrowly scoped, revocable API key where supported, monitor credit usage, and rotate the key immediately if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search - one call, up to 200 complete app rows. No pagination: raise limit.
apps = requests.post(f"{BASE}/api/v1/appstore/search", headers=HEADERS,
    json={"term": "habit tracker", "limit": 200, "country": "us"}).json()

# 2. A publisher's catalogue - the same search endpoint, a developer name as the term

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

HEADERS = {"Authorization": f"Bearer {API_KEY}"}

# 1. Search - one call, up to 200 complete app rows. No pagination: raise limit.
apps = requests.post(f"{BASE}/api/v1/appstore/search", headers=HEADERS,
    json={"term": "habit tracker", "limit": 200, "country": "us"}).json()

# 2. A publisher's catalogue - the same search endpoint, a developer name as the term

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

json={"term": "Notion Labs", "limit": 50}).json()

# 3. One app, by numeric id or by bundle id - identical payload
app = requests.post(f"{BASE}/api/v1/appstore/app", headers=HEADERS,
    json={"app_id": "1232780281"}).json()

same_app = requests.post(f"{BASE}/api/v1/appstore/app", headers=HEADERS,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md

json={"term": "Notion Labs", "limit": 50}).json()

# 3. One app, by numeric id or by bundle id - identical payload
app = requests.post(f"{BASE}/api/v1/appstore/app", headers=HEADERS,
    json={"app_id": "1232780281"}).json()

same_app = requests.post(f"{BASE}/api/v1/appstore/app", headers=HEADERS,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

json={"app_id": "notion.id"}).json()

4. Reviews - numeric id only, page 1-10, 50 per page

reviews = requests.post(f"{BASE}/api/v1/appstore/reviews", headers=HEADERS, json={"app_id": "1232780281", "page": 1, "sort": "most_helpful"}).json()

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

json={"app_id": "notion.id"}).json()

4. Reviews - numeric id only, page 1-10, 50 per page

reviews = requests.post(f"{BASE}/api/v1/appstore/reviews", headers=HEADERS, json={"app_id": "1232780281", "page": 1, "sort": "most_helpful"}).json()

text

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:37