add-app-clip
Warn
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user to execute commands such as bunx setup-safari and bunx testflight. These commands dynamically download and run packages from the npm registry without version constraints.
- [REMOTE_CODE_EXECUTION]: The setup-safari tool is used to log into Apple Developer accounts and register bundle identifiers. Executing third-party scripts that handle sensitive authentication credentials presents a risk of credential theft or unauthorized account access.
- [EXTERNAL_DOWNLOADS]: The skill relies on the @bacons/apple-targets package and references external documentation on sosumi.ai. The instruction to use bunx testflight is particularly risky due to potential name collisions with unrelated, older packages on the npm registry, which could result in the execution of unintended software.
Audit Metadata