app store optimization

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:31 PM UTC
• Version: 1.0.0

Overview

This is a Markdown-only ASO guidance skill with no executable behavior, persistence, credential access, or data export, though users should avoid copying competitor review text verbatim and should correct the report attribution template.

Safe to install for ASO drafting and analysis. Before using outputs publicly, review any competitor-derived wording for originality and substantiation, and replace the hard-coded 'Claude' report attribution with the actual preparer or remove it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

• Location: references/strategy-report.md:17
• Finding: Hardcoded Third-Party Attribution in the Mandatory Report Template<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:71` - `references/strategy-report.md:17-25` **Vulnerability Type**: Output instruction hijacking through a mandatory template **Risk Level**: Low ### Complete Vulnerable Code Snippets `SKILL.md:71`: ```markdown - **Full strategy report**: Read all reference files, then use the report template in `references/strategy-report.md` ``` `references/strategy-report.md:17-25`: ```markdown ## Report Template ```markdown # [App Name] — ASO Strategy Report **Platform**: iOS / Android / Both **Category**: [Category] **Primary Markets**: [Markets] **Report Date**: [Date] **Prepared by**: ASO Specialist (Claude) ``` ### Technical Analysis The primary skill instructions require the agent to use `references/strategy-report.md` when producing a comprehensive ASO strategy. That template contains a hardcoded attribution to a specific third-party AI brand: ```markdown **Prepared by**: ASO Specialist (Claude) ``` Because the attribution is fixed rather than supplied by the user or derived from the actual execution environment, loading and following the skill can alter the agent's output by inserting misleading authorship information. This behavior is unrelated to the substantive ASO functionality and constitutes instruction-level output manipulation. The issue is deterministic: any compliant agent generating the prescribed full report can reproduce the attribution, regardless of which model, organization, or person actually prepared the report. ### Attack Path 1. A user installs or invokes the ASO skill. 2. The user requests a complete ASO strategy or comprehensive report. 3. The instructions in `SKILL.md` direct the agent to load and use `references/strategy-report.md`. 4. The agent follows the mandatory report template. 5. The generated report includes `Prepared by: ASO Specialist (Claude)`. 6. The output consequently presents unsolicited and potentially false third-party authorship. No code execution ...[truncated 783 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hardcoded third-party attribution: ```markdown **Prepared by**: ASO Specialist (Claude) ``` 2. Prefer omitting the authorship field unless the user explicitly requests it. 3. If attribution is required, replace it with a neutral placeholder: ```markdown **Prepared by**: [Author or organization provided by the user] ``` 4. Add an instruction that placeholders must only be populated using verified user-provided information and must not infer a model, vendor, or organization. 5. Review all output templates for fixed brand names, endorsements, authorship claims, promotional text, or unrelated content. 6. Add a regression test confirming that comprehensive reports contain no vendor attribution unless the user explicitly supplies or requests it. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Context Leakage

High

• Category: Data Exfiltration

Content

The most common mistake is generating a full strategy report when the user only needed help with one thing. Your job is to understand what they actually need before producing any detailed output.

**The mandatory two-step gate:**
1. Extract context from what the user shared (no need to re-ask what they already told you)
2. State your diagnosis and proposed focus — then WAIT for their confirmation before going deep

This is not optional. Even if the user gave you extensive information, you must still surface your diagnosis and get a green light before generating detailed outputs. A brief "here's what I see and where I think we should start — sound right?" takes 3 lines and saves everyone from getting a 10-section report they didn't ask for.

• Confidence: 75% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Context Leakage

High

• Category: Data Exfiltration

Content

This is not optional. Even if the user gave you extensive information, you must still surface your diagnosis and get a green light before generating detailed outputs. A brief "here's what I see and where I think we should start — sound right?" takes 3 lines and saves everyone from getting a 10-section report they didn't ask for.

## Step 1: Extract Context

From the user's opening message, extract what you already know:
- App name and category (iOS / Android / both)

• Confidence: 75% confidence
• Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill’s trigger description is very broad, covering generic 'mobile app marketing' tasks and common user phrases like low downloads or needing help writing an app description. This can cause unintended invocation outside narrow ASO use cases, leading the agent to route conversations into this skill when a more appropriate or safer skill should handle them.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This expected output requires the assistant to respond in Chinese (for example, '应先提取上下文' and the required checkpoint wording) even though the rule set says language/locale constraints should not be forced without user opt-in. The file is a JSON eval file, so SQP-3 applies, and there is no indication that language choice is optional or justified.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The expected output is written as a required Chinese response behavior and does not indicate that the assistant may adapt to user language preference. Under the natural-language policy rule, forcing a specific language without opt-in is a policy concern unless clearly documented and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This expected output defines required behavior in Chinese and provides no option to adapt language based on user preference. Because SQP-3 applies to all file types, this constitutes a language policy violation in the file's natural-language content.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The file explicitly advises users to copy the exact words from competitors' positive reviews into their own description copy. That creates policy, attribution, and deceptive-marketing risk because third-party review text may be reused without permission or presented out of context, and it encourages imitation rather than original substantiation. In an ASO skill, this is more dangerous because users are likely to operationalize the guidance directly in public storefront metadata.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The guidance states that 'Japanese users respond to precision and detail; US users respond to outcomes and social proof; German users respond to features and specifications' as generalized rules. This imposes locale-based communication policy in natural language without offering user choice, opt-in, or a clearly documented compliance justification.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: The section on screenshot localization instructs creators to adapt content by market with fixed country-specific patterns such as 'US/UK: outcome-focused' and 'Japan: feature-focused.' This imposes locale-specific defaults in natural language without mentioning user opt-in, choice, or a documented compliance reason, which can violate language/locale policy constraints.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The template hard-codes the preparer as "ASO Specialist (Claude)", which can misrepresent the assistant's identity or imply a specific underlying model without user consent. While not a direct security exploit, this is a trust and provenance issue that could mislead users, especially in shared stakeholder-facing documents.

Static analysis

No suspicious patterns detected.