Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
TestFlight
v1.0.0Distribute iOS and macOS beta builds with TestFlight, tester management, and CI/CD automation.
⭐ 0· 681·1 current·1 all-time
byIván@ivangdavila
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description (TestFlight distribution, tester management, CI/CD) align with the content of SKILL.md and ci-cd.md. All commands and examples (fastlane, xcrun altool, keychain operations, GitHub/GitLab CI snippets) are coherent for uploading builds and automating TestFlight distribution on macOS.
Instruction Scope
Instructions stay within TestFlight/CI setup scope and do not direct the agent to read unrelated system files or contact non-Apple endpoints. They do, however, instruct creating keychains, importing certificates, writing API key files, and echoing base64-decoded secrets into the workspace — behavior that is expected for CI automation but sensitive. The SKILL.md/ci-cd.md do not instruct any exfiltration, but they give the agent broad discretion to handle secrets in the workspace (e.g., echoing secrets to files).
Install Mechanism
Instruction-only skill with no install spec or included code files. Lowest disk/write risk from the skill itself — it does not download or execute third-party installers. All potentially executed tools (fastlane, security, xcrun) are standard macOS/CI tooling and are expected for this purpose.
Credentials
The skill declares no required env vars, yet both SKILL.md and ci-cd.md repeatedly reference multiple sensitive environment variables/secrets (APPSTORE_API_KEY / api_key.json, APPSTORE_API_KEY_ID, APPSTORE_API_ISSUER_ID, P12_PASSWORD, P12_BASE64, PROVISION_BASE64, FASTLANE_APPLE_APPLICATION_SPECIFIC_PASSWORD, etc.). Those secrets are legitimate for TestFlight automation, but the omission from the skill metadata is an inconsistency: the agent/platform cannot automatically know which secrets will be needed. The CI examples also write secrets to disk (api_key.json, cert.p12, profiles), and they create/unlock a keychain with an empty password in examples — practices that can expose secrets on shared runners if not tightly controlled.
Persistence & Privilege
always is false and the skill is user-invocable; it does not request persistent presence or modify other skills. Autonomous invocation is allowed (platform default), which is normal for skills, but combine that with the environment concerns above (sensitive secrets) when granting autonomous access.
What to consider before installing
This skill is instruction-only and otherwise coherent for TestFlight automation, but it expects several sensitive CI secrets and certificate files even though the registry metadata lists none. Before installing or running it, ensure you: 1) do not commit .p8/.p12 or decoded secret files into repos or logs; 2) store APPSTORE API keys, P12 and provisioning profiles in your CI secret store (not plaintext), and prefer the App Store Connect API key over app-specific passwords as suggested; 3) restrict runner access and avoid using shared/public runners when decoding private keys or unlocking keychains with empty passwords; 4) verify Fastlane and tooling versions you’ll run; and 5) be cautious if you let an autonomous agent execute these steps — confirm it will not upload workspace files or secrets to any non-Apple endpoint. The main technical issue is a metadata/declared-env mismatch (the skill should list the env vars it requires); if the publisher can provide a corrected metadata listing required secrets or clarify where secrets are expected, that would reduce risk. If you want, I can list the exact env vars and files referenced so you can pre-configure them in your CI secrets.Like a lobster shell, security has layers — review code before you run it.
latestvk979t0y3a0sm30y0e75439c3x181eh8e
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛫 Clawdis
OSmacOS