add-app-clip
Fail
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute
bunx setup-safariandbunx testflight. These are not official Expo or Apple utilities and involve downloading and executing code from the public NPM registry at runtime. - [CREDENTIALS_UNSAFE]: The
setup-safaricommand is described as logging into the user's Apple Developer account to register bundle IDs and create App Store entries. This requirement poses a significant risk for harvesting developer credentials or session tokens through untrusted third-party code. - [EXTERNAL_DOWNLOADS]: The skill directs users to
https://sosumi.aifor critical technical documentation regarding Associated Domains and App Clip configuration. This is an unofficial domain with no established trust relationship to the Expo organization or Apple. - [DATA_EXFILTRATION]: The combination of high-privilege Apple Developer account access and the execution of unverified scripts through
bunxcreates a potential channel for sensitive account data exfiltration. - [REMOTE_CODE_EXECUTION]: The skill specifies a target icon hosted at
https://github.com/expo.png. While the domain is reputable, the use of remote assets in build-time configuration can lead to unexpected behavior if the source is compromised.
Recommendations
- AI detected serious security threats
Audit Metadata