app-store-deployment
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The workflow references GitHub Actions which are fetched and executed at runtime (actions/checkout@v4 -> https://github.com/actions/checkout and r0adkll/upload-google-play@v1 -> https://github.com/r0adkll/upload-google-play), meaning remote code is pulled in as a required runtime dependency.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (medium risk: 0.60). The prompt includes an explicit sudo command ("sudo xcodebuild -license accept") which asks for elevated privileges on the host, so it pushes the agent to perform privileged actions even though most other steps are repository-level build/deploy operations.
Audit Metadata