app-store-publish
Warn
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: MEDIUMDATA_EXFILTRATIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [DATA_EXFILTRATION]: The skill accesses highly sensitive local directories and system assets, specifically
~/Library/MobileDevice/Provisioning Profiles/and the macOS Keychain, to evaluate code signing status. While necessary for iOS deployment, this exposes cryptographic identities and signing assets to the agent context. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through the ingestion of untrusted project metadata. It reads files such as
*.xcodeproj,*.xcworkspace, andpubspec.yamlto identify project parameters without implementing sanitization or boundary markers. This ingestion surface, combined with the skill's capability to execute shell commands and write files, creates a risk that malicious instructions embedded in project files could hijack the deployment process. - [COMMAND_EXECUTION]: The agent is instructed to operate with high autonomy ("Do NOT ask the user questions") while executing complex build and distribution commands via Fastlane and Xcode tools. This reduces human oversight during sensitive operations like app signing and submission.
- [DATA_EXFILTRATION]: The skill implements a telemetry mechanism that writes execution outcomes and metadata to
~/.claude/projects/skill-telemetry.md. This results in persistent data collection about user projects and deployment status in a hidden directory.
Audit Metadata