Security audit

Appkittie

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent App Store research skill suite that uses AppKittie APIs as disclosed, with practical install and API-key handling cautions.

Install only from a trusted AppKittie source, prefer a pinned release or reviewed commit, and store the AppKittie API key in your MCP client's secret mechanism or a protected local configuration rather than shared project files. Expect the skills to send app-market queries and keywords to AppKittie and to optionally keep a local app-marketing-context.md file for reuse.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Executable Dependency and Mutable Remote Skill Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:45
Finding: Bearer API Key Exposed Through Shell Arguments and Plaintext MCP Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (14)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
s coding agents load **Agent Skills** from disk: each skill is a folder with a `SKILL.md` (and optional files), placed where your tool looks—commonly `.cursor/s

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
s coding agents load **Agent Skills** from disk: each skill is a folder with a `SKILL.md` (and optional files), placed where your tool looks—commonly `.cursor/s

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
--- ## Install the skills Today’s coding agents load **Agent Skills** from disk: each skill is a folder with a `SKILL.md` (and optional files), placed where your tool looks—commonly `.cursor/skills/`, `.claude/skills/`, `.agents/skills/`, or `.codex/skills/`. You either **copy** those folders, **subscribe** to a remote rule (Cursor), or use a **CLI** that fetches from GitHub (Claude Code).

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.
md
Full parameter matrix: [tools/REGISTRY.md](tools/REGISTRY.md). ### cURL samples High-revenue fitness slice:

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description includes very broad trigger phrases such as general references to advertising, competitors, creatives, and user acquisition, which can cause the skill to activate in conversations that are only loosely related to ad intelligence. Over-broad activation increases the chance of inappropriate tool use, unintended data access, or steering the agent away from the user's actual intent, especially in multi-skill environments.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description contains broad trigger phrases such as "find apps", "search apps", and "show me apps that," which can match many ordinary user requests beyond the intended App Store discovery use case. This can cause the agent to invoke the skill inappropriately, leading to workflow hijacking, reduced reliability, and unintended access to app-market analysis tooling when another skill or a general response would be more appropriate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description contains broad activation phrases such as "set up my app", "configure my app context", and "before running any other skill for the first time," which can cause the skill to trigger in situations where the user did not explicitly request it. Unintended invocation can lead to workflow hijacking, unnecessary data collection prompts, and interference with more appropriate skills, especially because this skill is positioned as a prerequisite for many others.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description contains very broad trigger phrases such as 'compare apps', 'who are my competitors', and 'what are similar apps doing', which can match many routine product, marketing, or research requests outside a tightly scoped competitor-analysis workflow. Over-broad activation can cause the wrong skill to run, leading to unintended data gathering, unnecessary use of external tools, and reduced reliability of agent behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill when the user wants to analyze app growth trends and includes phrases like "trending apps" and "what apps are growing," which are broad enough to match ordinary exploratory requests. The trigger guidance lacks negative examples or tighter constraints to distinguish this skill from adjacent analysis skills, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase "find keywords" is overly broad and can match many ordinary user requests outside the intended ASO/App Store optimization context, causing accidental invocation of this skill. Unintended activation can route user requests to the wrong workflow, leading to confused behavior, incorrect tool usage, or inappropriate access to app-marketing context and keyword-analysis functions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation description includes phrases like "write my title" and "improve my subtitle," which are generic enough to match ordinary editing requests outside the intended App Store metadata context. Although the line mentions App Store listing metadata, it does not provide negative examples or tighter boundaries for when these common phrases should not invoke the skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description says to use the skill when the user wants to understand 'pricing models' or 'pricing strategy' and includes generic triggers like 'monetization'. These terms are broad and could match many ordinary conversations outside the intended mobile app revenue-analysis context, increasing the chance of unintended invocation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.