release-mac-app

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The outsider-authored text is the app repo’s CHANGELOG.md (and related release manifest inputs) which is directly read/processed at runtime by the skill (e.g., extract_notes_from_changelog, ensure_changelog_finalized, and HTML conversion), so the workflow ingests free text before selecting a specific item.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs automated manipulation of macOS keychains (normalizing partition ACLs, prepending/search-list mutations) and supports a passwordless/unlocked keychain mode that disables timeout/lock settings, which are security-sensitive modifications that change machine state and can weaken or bypass protections.