upload-ios-build
Fail
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: HIGHDATA_EXFILTRATIONCREDENTIALS_UNSAFECOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill is designed to exfiltrate the user's GitHub authentication token by executing
gh auth tokenand sending the result as a Bearer token in an HTTP header tohttps://app-distro.onemany.workers.dev. This grants the third-party service the same level of access to the user's GitHub account as the local CLI tool. - [DATA_EXFILTRATION]: The skill uploads the entire compiled iOS IPA binary to an external URL. This action sends potentially proprietary application code and assets to an unverified external service.
- [CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to retrieve and transmit active session credentials (
gh auth token). While it contains a directive to "Never print or store the GitHub token," the transmission to an external server constitutes a significant credential safety violation. - [COMMAND_EXECUTION]: The skill performs automated shell command execution involving
gh,plutil,ditto, andshasumto extract metadata and prepare data for exfiltration.
Recommendations
- AI detected serious security threats
Audit Metadata