Security audit

Aso Audit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward App Store and Google Play listing audit guide with no executable code, persistence, or hidden data movement.

Install this if you want an agent to audit app-store listings. Be aware it may read a local product marketing context file if one exists and may fetch public App Store or Google Play pages and screenshots to support the audit.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (31)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description contains very broad activation phrases like general marketing and optimization requests, which can cause the agent to invoke this skill outside its intended ASO-specific scope. Over-broad routing increases the chance that unrelated user requests are handled with the wrong workflow, causing inappropriate web fetching, incorrect advice, or data exposure from unnecessary context reads.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
### Tier definitions | Tier | Signals | Examples | | --------------- | ------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------- | | **Dominant** | Household name, 1M+ ratings, top-10 in category, near-universal brand recognition. Users search by brand name, not generic keywords. | Instagram, Uber, Spotify, WhatsApp, Netflix | | **Established** | Well-known in their category, 100K+ ratings, strong organic installs, recognized brand but not universally known. | Strava, Notion, Duolingo, Cash App, Calm |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 41)May include surrounding context.
md
**Challenger rubric:** | Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 44)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 47)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 108)May include surrounding context.
md
| Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 45)May include surrounding context.
md
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 181)May include surrounding context.
md
| ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 46)May include surrounding context.
md
| 9-10 | Brand + high-value keyword in title, complementary keywords in subtitle, no word repetition across fields, near max character usage, instantly communicates app purpose | | 7-8 | Good keyword presence, minor character waste (5+ unused chars), clear purpose | | 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 48)May include surrounding context.
md
| 5-6 | Has keywords but poor placement, some repetition between fields, purpose somewhat clear | | 3-4 | Title is brand-only or generic, subtitle missing or weak, poor character usage | | 1-2 | No keyword strategy, title doesn't communicate purpose, major character waste | | 0 | Cannot assess (data unavailable) | **Dominant/Established adjustment:** Brand-only titles (e.g., "Instagram") are valid if the brand has high search volume. Score 8+ for Dominant apps where

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 70)May include surrounding context.
md
### Apple App Store | Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 73)May include surrounding context.
md
| Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 75)May include surrounding context.
md
| Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | | 9-10 | First 3 lines hook with clear value prop, structured with features/benefits/social proof/CTA, promotional text actively used, compelling and scannable | | 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 76)May include surrounding context.
md
| 7-8 | Good opening, decent structure, could improve scannability or CTA | | 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort | | 0 | Cannot assess | ### Google Play

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 77)May include surrounding context.
md
| 5-6 | Generic opening ("Welcome to..."), some structure, missing CTA or social proof | | 3-4 | Wall of text, no clear value prop above fold, no promotional text | | 1-2 | Minimal or boilerplate description, no effort | | 0 | Cannot assess | ### Google Play

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 81)May include surrounding context.
md
### Google Play | Score | Criteria | | ----- | -------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Keywords in first 3 sentences, 2-3% natural density throughout, HTML formatting used, structured sections, strong CTA, keywords feel natural | | 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 86)May include surrounding context.
md
| 9-10 | Keywords in first 3 sentences, 2-3% natural density throughout, HTML formatting used, structured sections, strong CTA, keywords feel natural | | 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 87)May include surrounding context.
md
| 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 129)May include surrounding context.
md
| 7-8 | Good keyword presence, some structure, density slightly off (1-2% or 3-4%) | | 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 88)May include surrounding context.
md
| 5-6 | Keywords present but sparse (<1%) or stuffed (>5%), weak structure | | 3-4 | No keyword strategy visible, poor formatting, wall of text | | 1-2 | Minimal description, no keywords, no structure | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 104)May include surrounding context.
md
## 3. Visual Assets (Weight: 25%) | Score | Criteria | | ----- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 9-10 | 8-10 screenshots with clear messaging/captions, preview video present, screenshots tell a story in sequence, each communicates one benefit, icon is distinctive and memorable | | 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 109)May include surrounding context.
md
| 9-10 | 8-10 screenshots with clear messaging/captions, preview video present, screenshots tell a story in sequence, each communicates one benefit, icon is distinctive and memorable | | 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear | | 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 110)May include surrounding context.
md
| 7-8 | 6-7 screenshots with captions, good icon, no video OR good video but some screenshot messaging unclear | | 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 111)May include surrounding context.
md
| 5-6 | 5+ screenshots but weak/no captions, basic icon, no video, screenshots are UI dumps | | 3-4 | 3-4 screenshots, no captions, generic icon, no storytelling | | 1-2 | Fewer than 3 screenshots, or screenshots are raw unedited UI, poor icon | | 0 | Cannot assess | **Check for:**

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/scoring-criteria.md (reported line 152)May include surrounding context.
md
## 5. Metadata & Freshness (Weight: 10%) | Score | Criteria | | ----- | ------------------------------------------------------------------------------------------------------------------------- | | 9-10 | Updated within last month, 10+ localizations, optimal category choice, in-app events/LiveOps active, data safety complete | | 7-8 | Updated within 2 months, 5+ localizations, good category, data safety present |