TestFlight

Distribute iOS and macOS beta builds with TestFlight, tester management, and CI/CD automation.

This skill is instruction-only and otherwise coherent for TestFlight automation, but it expects several sensitive CI secrets and certificate files even though the registry metadata lists none. Before installing or running it, ensure you: 1) do not commit .p8/.p12 or decoded secret files into repos or logs; 2) store APPSTORE API keys, P12 and provisioning profiles in your CI secret store (not plaintext), and prefer the App Store Connect API key over app-specific passwords as suggested; 3) restrict runner access and avoid using shared/public runners when decoding private keys or unlocking keychains with empty passwords; 4) verify Fastlane and tooling versions you’ll run; and 5) be cautious if you let an autonomous agent execute these steps — confirm it will not upload workspace files or secrets to any non-Apple endpoint. The main technical issue is a metadata/declared-env mismatch (the skill should list the env vars it requires); if the publisher can provide a corrected metadata listing required secrets or clarify where secrets are expected, that would reduce risk. If you want, I can list the exact env vars and files referenced so you can pre-configure them in your CI secrets.

Type: OpenClaw Skill Name: testflight Version: 1.0.0 The skill is designed for legitimate CI/CD operations involving TestFlight, but it demonstrates several high-risk capabilities. It includes direct shell command execution examples (`xcrun altool`, `security`, `base64 -d`, `echo > file`) in `SKILL.md` and `ci-cd.md`. These commands handle sensitive cryptographic materials (API keys, P12 certificates, provisioning profiles) by decoding them from environment variables and writing them to files. While necessary for the stated purpose, these operations present a significant attack surface for shell injection or sensitive data exposure if the AI agent's input sanitization is insufficient, making the skill suspicious due to potential vulnerabilities rather than explicit malicious intent.