Audit App Store Readiness

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6b3c86d39332498386c4544a7ea9d91ba357e650f3736964955af75dd9ab8c75
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the presence of high-risk execution capabilities, even though the stated intent appears benign. The `SKILL.md` instructs the AI agent to execute `xcodebuild build` commands, which compile and link code from the repository, creating artifacts. While this is for a simulator and part of an 'audit', it represents a significant code execution capability. Additionally, the `scripts/audit.mjs` file defines a `runShell` function that uses the platform shell (`/bin/bash -lc` or `cmd.exe /c`), allowing arbitrary shell command execution; although this function is not called within `audit.mjs`, its presence indicates a high-risk capability. The script does include a positive security feature by actively scanning for potential secrets (e.g., `.p12`, `.env`, SSH keys) within the repository, which is a mitigating factor against malicious intent but does not negate the risky capabilities.