Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed screenshot-generation integration that reads app metadata and sends a limited project summary to its API, with no evidence of hidden persistence or destructive behavior.
Install this only for projects where you are comfortable sending selected app metadata, feature summaries, screen names, colors, and marketing copy to appscreenshotstudio.com. Review what the agent found before generation, avoid including secrets or private roadmap details, and keep the API key in an environment variable or secret manager.
The phrase "or wants to ship a new app" is ambiguous and much broader than screenshot generation, so it could match many ordinary release-related requests that are not actually asking for this skill. The trigger list does not provide exclusion conditions or clarify when release-related requests should not invoke the skill.
The skill explicitly instructs the agent to read multiple local project files and assemble codebase-derived context, then send that context to a third-party API. Without a prominent user-facing warning and explicit consent gate, sensitive business information, metadata, unreleased features, or internal copy can be exfiltrated outside the local environment.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
package.json / pubspec.yaml / Cargo.toml / build.gradle — app name, tech stacktailwind.config.* (theme.extend.colors), SwiftUI Color(, Flutter ThemeDataapp/ routes, SwiftUI NavigationView/TabView, Flutter GoRouterInfo.plist, fastlane metadata/, AndroidManifest.xmlBuild this context:
This is a direct external transmission path that sends assembled codebase context to a remote service using a bearer-authenticated API call. Because the prior steps encourage harvesting information from README, manifests, routes, themes, and metadata, the outbound request can leak proprietary product plans or sensitive internal details if performed without strict scoping and consent.
3a. Create a project:
curl -s -X POST https://appscreenshotstudio.com/api/v1/projects \
-H "Authorization: Bearer $APPSCREENSHOTSTUDIO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
The skill requires an API key but does not warn users about safe credential handling, storage, rotation, or avoiding exposure in logs and shell history. In agent and terminal workflows, poor guidance around secrets can lead to accidental leakage or misuse of the bearer token.
No suspicious patterns detected.