App Store Changelog

Create user-facing App Store release notes by collecting and summarizing all user-impacting changes since the last git tag (or a specified ref). Use when ask...

This skill appears to be what it says: it runs a small git-based script to list commits and touched files and then drafts App Store release notes. Before installing or running it, be aware that: (1) the script requires git but the metadata doesn't declare that — ensure git is available where the agent runs; (2) the script will print the repository root, commit messages, and file paths, so sensitive data in commit messages or filenames could be exposed; (3) run it only on repositories you trust or in an environment where viewing repo history is acceptable. If you want extra caution, inspect the commit output produced by scripts/collect_release_changes.sh before allowing the agent to summarize or transmit those contents, or run the script locally yourself and paste only the needed output into the agent.

Type: OpenClaw Skill Name: qui-app-store-changelog Version: 1.0.0 The skill is designed to generate App Store release notes from git history, but it contains a shell injection vulnerability in `scripts/collect_release_changes.sh`. The script passes the `since_ref` and `until_ref` arguments directly into a shell command without sanitization or quoting, which could allow arbitrary command execution if a malicious git tag or reference name is used. While the behavior aligns with the stated purpose and lacks evidence of intentional malice, the lack of input validation is a high-risk flaw.