Skills/npm/fast-ios-device-test

fast-ios-device-test@2.2.2

CAUTION· install only

Publisher claims: "Fast iOS UI-flow verification for AI coding agents: Simulator, physical-iPhone and CarPlay flows, video review, and PR evidence." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher dungvc-dev · publishing for 12 daysInstalls 2,714Last detonated 6 h ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-14 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration; Auto-update or dynamic fetch configuration. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sfilesystemread ~/.local/share/fast-ios-device-test outside project
0.1sfilesystemwrote ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/examples/carplay-widget.json · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/device.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/usage.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/review.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/liquid-glass.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/carplay.md
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/sed
0.1sprocessexec /usr/bin/rm
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexec /usr/bin/cp
0.1sprocessexited 1:
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.3sfilesystemread ~/.local/share/fast-ios-device-test outside project
0.3sfilesystemwrote ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/examples/carplay-widget.json · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/device.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/usage.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/review.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/liquid-glass.md · ~/.local/share/fast-ios-device-test/skills/fast-ios-device-test/references/carplay.md
0.3sprocessexec /usr/bin/dirname
0.3sprocessexec /usr/bin/sed
0.3sprocessexec /usr/bin/rm
0.3sprocessexec /usr/bin/mkdir
0.3sprocessexec /usr/bin/cp
0.3sprocessexited 1:

Static findings

HIGH
Auto-update or dynamic fetch configurationnpm/install.js:4 · Auto-update or dynamic fetch configuration — agent may load new code at runtime// npx fast-ios-device-test auto-update on|off|status manage the daily launchd updaterFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationnpm/install.js:177 · Auto-update or dynamic fetch configuration — agent may load new code at runtimefunction autoUpdate(action) {Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationscripts/fast_auto_update.py:135 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeprint(f"auto-update: on (daily; turn off: npx {PACKAGE} auto-update off)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationinstall.sh:133 · Auto-update or dynamic fetch configuration — agent may load new code at runtimepython3 "$SOURCE/scripts/fast_auto_update.py" off || trueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:220 · Collapsed <details> block carrying instructions<summary>Flow the agent writes</summary> ```json { "version": 1, "name": "device-home", "app": { "project_root": "/absolute/path/to/project", "bundle_id": "com.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationscripts/fast_update.py:374 · Auto-update or dynamic fetch configuration — agent may load new code at runtimehint = f"run: npx {PACKAGE} update; auto-update: npx {PACKAGE} auto-update on"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationscripts/fast_auto_update.py:34 · Auto-update or dynamic fetch configuration — agent may load new code at runtimedefault = Path.home() / "Library/Caches" / PACKAGE / "auto-update.json"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationinstall.sh:341 · Auto-update or dynamic fetch configuration — agent may load new code at runtimepython3 "$HERE/scripts/fast_auto_update.py" on "$HERE"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
CRITICAL
Prompt injectionskills/fast-ios-device-test-setup/SKILL.md:35 · Prompt injection — known jailbreak technique referencesigning, trust, Developer Mode, or profile fix. Do not guess a device when several are present.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
HIGH
Auto-update or dynamic fetch configurationnpm/install.js:188 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconst commandArgs = [path.join(managerRoot, "scripts", "fast_auto_update.py"), action];Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:180 · Collapsed <details> block carrying instructions<summary>Flow the agent writes</summary> ```json { "version": 1, "name": "settings-general-smoke", "app": { "project_root": "/absolute/path/to/project", "bundleFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationscripts/fast_auto_update.py:234 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeprint("usage: fast_auto_update.py on [root] | off | status | --run", file=sys.stderr)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:254 · Collapsed <details> block carrying instructions<summary>Flow the agent writes</summary> ```json { "version": 1, "name": "duo-displays", "app": { "project_root": "/absolute/path/to/project", "bundle_id": "comFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationinstall.sh:344 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeecho "auto-update: unchanged (--link clone updates with git)"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Collapsed <details> block carrying instructionsREADME.md:300 · Collapsed <details> block carrying instructions<summary>Flow the agent writes</summary> ```json { "version": 1, "name": "carplay-home", "app": { "project_root": "/absolute/path/to/project", "bundle_id": "comFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Collapsed <details> block carrying instructionsREADME.md:347 · Collapsed <details> block carrying instructions<summary><strong>Where does Simulator DerivedData go?</strong></summary> `fastSimulatorTest` shares one cache across all worktrees of a repository under `~/LibrFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Auto-update or dynamic fetch configurationinstall.sh:208 · Auto-update or dynamic fetch configuration — agent may load new code at runtimepython3 "$SOURCE/scripts/fast_auto_update.py" status || trueFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationnpm/install.js:179 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeconsole.error(`usage: npx ${PACKAGE} auto-update on|off|status`);Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_device.py:55 · Python subprocess execution detectedresult = subprocess.run(args, text=True, capture_output=True, env=env, **kwargs)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_device.py:336 · Python subprocess execution detectedresult = subprocess.run(["security", "cms", "-D", "-i", str(path)], capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Auto-update or dynamic fetch configurationskills/fast-ios-device-test-setup/SKILL.md:32 · Auto-update or dynamic fetch configuration — agent may load new code at runtime`npx fast-ios-device-test auto-update on|off|status`; `--link` does not enable it automatically.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_update.py:226 · Python subprocess execution detectedresult = subprocess.run([str(path), "--version"], capture_output=True, text=True, timeout=10, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionnpm/install.js:136 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("gemini: the extension update failed (output above)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagenpm/install.js:4 · npx invocation of non-well-known package — may execute untrusted code// npx fast-ios-device-test auto-update on|off|status manage the daily launchd updaterFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_carplay.py:1003 · Python subprocess execution detectedrecorder = subprocess.Popen(["screencapture", "-v", "-l", str(info["id"]), str(video)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_update.py:126 · Python subprocess execution detectedinside = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagenpm/install.js:6 · npx invocation of non-well-known package — may execute untrusted code// npx fast-ios-device-test update-axe|update-baguette update one pinned toolFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_carplay.py:269 · Python subprocess execution detectedself.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_ui.py:77 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/fast_ui.py:1718 · File type combined with upload action — agent may exfiltrate local data files(derived_data / ".fastui-build.log").write_text(output)Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File permission modification commandinstall.sh:326 · File permission modification command — agent changes file ownership/permissionschmod +x "$HERE/scripts/fast_ui.py" "$HERE/scripts/fast_ui_report.py" "$HERE/scripts/fast_ui_review.py" "$HERE/scripts/fast_device.py" "$HERE/scripts/fast_carplay.py" \Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_media.py:128 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_device.py:877 · Python subprocess execution detectedprocess = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_ui_clean.py:108 · Python subprocess execution detectedfound = subprocess.run(["pgrep", "-f", "test-without-building.*(serve|run)-"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_evidence.py:311 · Python subprocess execution detectedlisted = json.loads(subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagenpm/install.js:5 · npx invocation of non-well-known package — may execute untrusted code// npx fast-ios-device-test update-tools pin and install latest AXe + baguette releasesFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_update.py:136 · Python subprocess execution detectedbehind = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionnpm/install.js:122 · File type combined with upload action — agent may exfiltrate local data filesconsole.log("antigravity: the plugin update failed (output above)");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionnpm/install.js:98 · File type combined with upload action — agent may exfiltrate local data fileselse { console.log("codex: the plugin update failed (output above)"); failed = 1; }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/fast_auto_update.py:135 · npx invocation of non-well-known package — may execute untrusted codeprint(f"auto-update: on (daily; turn off: npx {PACKAGE} auto-update off)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationskills/fast-ios-device-test-setup/SKILL.md:16 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeA normal install also enables the daily launchd updater and prints `auto-update: on …`; itFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_ui.py:3258 · Python subprocess execution detectedsubprocess.Popen(["xcrun", "simctl", "keychain", udid, "reset"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_update.py:132 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionnpm/install.js:110 · File type combined with upload action — agent may exfiltrate local data fileselse { console.log("claude: the plugin update failed (output above)"); failed = 1; }Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fast_device.py:146 · File type combined with upload action — agent may exfiltrate local data fileswith tempfile.NamedTemporaryFile(suffix=".json") as output:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Authorization escalation languageskills/fast-ios-device-test-setup/SKILL.md:35 · Authorization escalation languagesigning, trust, Developer Mode, or profile fix. Do not guess a device when several are present.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedscripts/fast_carplay.py:63 · Python subprocess execution detectedreturn subprocess.run(command, input=input_text, text=True, capture_output=True,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagenpm/install.js:2 · npx invocation of non-well-known package — may execute untrusted code// npx fast-ios-device-test install, or upgrade (copied to ~/.local/share/fast-ios-device-test)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_media.py:107 · Python subprocess execution detectedcompiled = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/fast_auto_update.py:92 · npx invocation of non-well-known package — may execute untrusted codenpx = shutil.which("npx")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_ui_review.py:157 · Python subprocess execution detectedsubprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageinstall.sh:161 · npx invocation of non-well-known package — may execute untrusted codeecho "delete them first with: npx fast-ios-device-test clean [--project <root>] --maps --yes"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_ui_review.py:165 · Python subprocess execution detectedcompleted = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/fast_auto_update.py:89 · npx invocation of non-well-known package — may execute untrusted code# launchd starts with a bare PATH: keep the folder that holds this shell's npx (nvm, fnm,Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_ui.py:2111 · Python subprocess execution detectedresult = subprocess.run(args, input=data, capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/fast_auto_update.py:192 · npx invocation of non-well-known package — may execute untrusted codedetail = f"major update available {current} -> {latest}; run npx {PACKAGE} update manually"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/fast_auto_update.py:93 · npx invocation of non-well-known package — may execute untrusted codefolders = ([str(Path(npx).parent)] if npx else []) + defaultsFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/fast_auto_update.py:204 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/fast_device.py:715 · File type combined with upload action — agent may exfiltrate local data fileswith tempfile.NamedTemporaryFile(suffix=".json") as output:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/fast_ui.py:1287 · Python subprocess execution detectedself.process = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagenpm/install.js:3 · npx invocation of non-well-known package — may execute untrusted code// npx fast-ios-device-test update upgrade to the latest version, then each agent's pluginFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/fast_device.py:343 · File type combined with upload action — agent may exfiltrate local data fileswith tempfile.NamedTemporaryFile(suffix=".json") as output:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/fast_auto_update.py:110 · Python subprocess execution detectedresult = subprocess.run([command, *args], capture_output=True, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_evidence.py:58 · Python subprocess execution detecteddone = subprocess.run(["git", "-C", str(root), *args], capture_output=True, text=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_ui.py:3457 · Python subprocess execution detectedsubprocess.Popen(call, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL) for call in callsFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/fast_device.py:69 · File type combined with upload action — agent may exfiltrate local data fileswith tempfile.NamedTemporaryFile(suffix=".json") as output:Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_install.py:446 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeself.assertIn("auto-update: unchanged (--link clone updates with git)", out)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/fast_update.py:372 · npx invocation of non-well-known package — may execute untrusted codehint = f"major update; run manually: npx {PACKAGE} update"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_update.py:197 · Python subprocess execution detectedout = subprocess.run([sys.executable, str(REPO / "scripts" / "fast_update.py"), "--status", str(root)],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/test_fast_update.py:78 · npx invocation of non-well-known package — may execute untrusted codef"run ./install.sh --link in {clone} or npx fast-ios-device-test",Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_media.py:154 · Python subprocess execution detecteddescribed = subprocess.run([*info, str(kept)], capture_output=True, text=True, timeout=120)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/test_fast_update.py:53 · npx invocation of non-well-known package — may execute untrusted code"auto-update: npx fast-ios-device-test auto-update on)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/test_install.py:437 · npx invocation of non-well-known package — may execute untrusted codeself.assertIn("auto-update: on (daily; turn off: npx fast-ios-device-test auto-update off)", out)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_ci.py:98 · Python subprocess execution detectedresult = subprocess.run(["bash", str(ROOT / "scripts/setup_repo_rules.sh")], cwd=raw,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/xcode_skills.py:54 · Python subprocess execution detectedselected = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_fast_update.py:53 · Auto-update or dynamic fetch configuration — agent may load new code at runtime"auto-update: npx fast-ios-device-test auto-update on)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_media.py:150 · Python subprocess execution detectedmade = subprocess.run([*make, str(clip), "1290", "2796", "24"], capture_output=True, text=True, timeout=600)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test/SKILL.md:18 · npx invocation of non-well-known package — may execute untrusted code`npx fast-ios-device-test auto-update status` and never change its setting unless the user asks.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/tool_manager.py:151 · Python subprocess execution detectedresult = subprocess.run([str(binary), "--version"], capture_output=True, text=True, timeout=15, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_install.py:52 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFAST_IOS_AUTO_UPDATE_STATUS=str(self.home / "auto-update.json"),Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_evidence.py:40 · Python subprocess execution detectedsubprocess.run(["git", "-C", str(root), "-c", "user.name=t", "-c", "[email protected]", *args],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_ui.py:2016 · Python subprocess execution detectedresult = fast_ui.subprocess.run([str(shim), "lint", "--strict"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_ui.py:1905 · Python subprocess execution detectedchecks = subprocess.run([str(binary)], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/fast_update.py:346 · npx invocation of non-well-known package — may execute untrusted codef"run ./install.sh --link in {clone} or npx {PACKAGE}"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_ui.py:1899 · Python subprocess execution detectedbuild = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_install.py:437 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeself.assertIn("auto-update: on (daily; turn off: npx fast-ios-device-test auto-update off)", out)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_optional_pillow.py:35 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_update.py:219 · Python subprocess execution detectedruns = [subprocess.Popen([sys.executable, "-c", code], cwd=REPO / "scripts", env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_install.py:229 · Python subprocess execution detectedran = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_update.py:184 · Python subprocess execution detectedran = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_ci.py:87 · Python subprocess execution detectedsubprocess.run(["git", "-C", raw, "remote", "add", "origin",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_conditions.py:134 · Python subprocess execution detecteddead = subprocess.Popen(["true"])Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/fast_update.py:253 · Python subprocess execution detectedsubprocess.Popen([sys.executable, str(Path(__file__).resolve()), "--refresh"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_update.py:209 · Python subprocess execution detectedran = subprocess.run([sys.executable, str(REPO / "scripts" / script), "--help"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_ci.py:86 · Python subprocess execution detectedsubprocess.run(["git", "init", "-q", raw], check=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/test_fast_update.py:1 · npx invocation of non-well-known package — may execute untrusted code"""fast_update (version, once-a-day notice) and `npx fast-ios-device-test update` (npm/install.js).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_install.py:88 · Python subprocess execution detectedresult = subprocess.run(["bash", str(REPO / "install.sh"), *args], env=self.env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_ui.py:1247 · Python subprocess execution detectedout = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_fast_update.py:420 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeself.assertEqual(fast_auto_update.enable(self.root), 0)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_update.py:227 · Python subprocess execution detectedrun = subprocess.Popen([sys.executable, str(REPO / "scripts" / "fast_ui.py"), "--help"], env=env,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test/SKILL.md:14 · npx invocation of non-well-known package — may execute untrusted codeare missing, use the bundled `fast-ios-device-test-setup` skill or run `npx fast-ios-device-test`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_fast_conditions.py:123 · Python subprocess execution detectedsleeper = subprocess.Popen(["sleep", "30"], start_new_session=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_fast_update.py:138 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeself.assertNotIn("auto-update on", line or "")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/fast_update.py:399 · npx invocation of non-well-known package — may execute untrusted codeline += f" (update: npx {PACKAGE} update)"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/fast_update.py:374 · npx invocation of non-well-known package — may execute untrusted codehint = f"run: npx {PACKAGE} update; auto-update: npx {PACKAGE} auto-update on"Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_install.py:175 · Python subprocess execution detectedinstalled = subprocess.run([str(self.home / "axe" / "axe"), "--version"], capture_output=True, text=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/test_fast_update.py:52 · npx invocation of non-well-known package — may execute untrusted code"(run: npx fast-ios-device-test update; "Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagescripts/test_fast_update.py:190 · npx invocation of non-well-known package — may execute untrusted codeself.assertIn("npx fast-ios-device-test update-axe", ran.stdout)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/test_ci.py:89 · Python subprocess execution detectedsubprocess.run(["git", "-C", raw, "remote", "add", "upstream",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Auto-update or dynamic fetch configurationscripts/test_fast_update.py:464 · Auto-update or dynamic fetch configuration — agent may load new code at runtimepath = fast_auto_update.plist(self.root)["EnvironmentVariables"]["PATH"].split(":")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/tool_manager.py:235 · Python subprocess execution detectedsubprocess.run(["xattr", "-dr", "com.apple.quarantine", str(staged)], capture_output=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_media.py:237 · Python subprocess execution detectedran = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/test_fast_ui.py:1985 · Python subprocess execution detectedresult = fast_ui.subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test-setup/SKILL.md:32 · npx invocation of non-well-known package — may execute untrusted code`npx fast-ios-device-test auto-update on|off|status`; `--link` does not enable it automatically.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languageskills/fast-ios-device-test/references/usage.md:752 · Authorization escalation language · informational: not an instruction file- The device must be unlocked, in Developer Mode, trusting this Mac, withFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionGUIDE.md:93 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileManagement; chờ Xcode chuẩn bị/copy shared cache; dùng Xcode khớp iOS; đặt passcode nếu DeveloperFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test-setup/SKILL.md:21 · npx invocation of non-well-known package — may execute untrusted code4. Run `npx fast-ios-device-test --check`. Setup is complete only when the last line isFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injectionGUIDE.md:88 · Prompt injection — known jailbreak technique reference · informational: not an instruction file`devicectl`, cache ngắn theo UDID). Nếu máy chưa ghép đôi/tin cậy, mất kết nối, tắt Developer Mode,Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageskills/fast-ios-device-test/references/device.md:7 · Authorization escalation language · informational: not an instruction filelists pairing, connection, Developer Mode, the Xcode and signing profile it will use, and theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionskills/fast-ios-device-test/references/device.md:330 · Prompt injection — known jailbreak technique reference · informational: not an instruction file| Developer Mode off / developer disk image unavailable | Enable Settings › Privacy & Security › Developer Mode, restart, then open Xcode once with the unlocked phone connected. |Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageGUIDE.md:93 · Authorization escalation language · informational: not an instruction fileManagement; chờ Xcode chuẩn bị/copy shared cache; dùng Xcode khớp iOS; đặt passcode nếu DeveloperFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionCHANGELOG.md:434 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileconnection, Developer Mode, developer disk image, the Xcode and signing profile a run will use,Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionskills/fast-ios-device-test/references/device.md:7 · Prompt injection — known jailbreak technique reference · informational: not an instruction filelists pairing, connection, Developer Mode, the Xcode and signing profile it will use, and theFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageskills/fast-ios-device-test/references/usage.md:10 · Authorization escalation language · informational: not an instruction file- Developer Mode is enabled.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Prompt injectionskills/fast-ios-device-test/references/device.md:208 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- Device must be unlocked, in Developer Mode, trusting the Mac; enableFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionGEMINI_EXTENSION.md:33 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- Verify device pairing, Developer Mode and signing: `fastDeviceTest check [--device <name|udid>]`.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Authorization escalation languageskills/fast-ios-device-test/references/device.md:16 · Authorization escalation language · informational: not an instruction fileone `FAIL error=<problem>: <fix>` line when pairing, connection, Developer Mode, the developer diskFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageCHANGELOG.md:434 · Authorization escalation language · informational: not an instruction fileconnection, Developer Mode, developer disk image, the Xcode and signing profile a run will use,Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test/SKILL.md:22 · npx invocation of non-well-known package — may execute untrusted code`npx fast-ios-device-test update-tools` when the user asks to update dependencies.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test-setup/SKILL.md:11 · npx invocation of non-well-known package — may execute untrusted code2. Run `npx fast-ios-device-test`. This installs or upgrades the engine inFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injectionSETUP.md:153 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- Settings › Privacy & Security › Developer Mode on (the iPhone restarts).Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionskills/fast-ios-device-test/references/usage.md:10 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- Developer Mode is enabled.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
LOW
Prompt injectionskills/fast-ios-device-test/references/usage.md:752 · Prompt injection — known jailbreak technique reference · informational: not an instruction file- The device must be unlocked, in Developer Mode, trusting this Mac, withFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test-setup/SKILL.md:28 · npx invocation of non-well-known package — may execute untrusted codeskill from the user's own Xcode only when requested with `npx fast-ios-device-test xcode-skills`Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Authorization escalation languageSETUP.md:153 · Authorization escalation language · informational: not an instruction file- Settings › Privacy & Security › Developer Mode on (the iPhone restarts).Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageskills/fast-ios-device-test/references/device.md:208 · Authorization escalation language · informational: not an instruction file- Device must be unlocked, in Developer Mode, trusting the Mac; enableFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageskills/fast-ios-device-test/references/device.md:330 · Authorization escalation language · informational: not an instruction file| Developer Mode off / developer disk image unavailable | Enable Settings › Privacy & Security › Developer Mode, restart, then open Xcode once with the unlocked phone connected. |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Context shift attemptskills/fast-ios-device-test/references/device.md:336 · Context shift attempt — trying to change operational mode · informational: not an instruction file| Developer Mode requires a passcode | Set a device passcode, enable Developer Mode, then retry. |Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageGEMINI_EXTENSION.md:33 · Authorization escalation language · informational: not an instruction file- Verify device pairing, Developer Mode and signing: `fastDeviceTest check [--device <name|udid>]`.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Authorization escalation languageGUIDE.md:88 · Authorization escalation language · informational: not an instruction file`devicectl`, cache ngắn theo UDID). Nếu máy chưa ghép đôi/tin cậy, mất kết nối, tắt Developer Mode,Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageskills/fast-ios-device-test-setup/SKILL.md:25 · npx invocation of non-well-known package — may execute untrusted coderequested with `npx fast-ios-device-test update-tools` (or a per-tool update command).Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Prompt injectionskills/fast-ios-device-test/references/device.md:16 · Prompt injection — known jailbreak technique reference · informational: not an instruction fileone `FAIL error=<problem>: <fix>` line when pairing, connection, Developer Mode, the developer diskFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST01

Cost to the agent

Instructions loaded
≈9,121 tok
3 files · 80 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for fast-ios-device-test@2.2.2 as of 6 h ago. This is the package itself, not its dependencies.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim dungvc-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Hidden instructions≈ +6 on the totalRemove HTML comments, zero-width characters and white-on-white text that carry instructions. Everything the agent is meant to read should be visible to the person reading the file.
  4. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  5. New publisher≈ +3 on the totalTime clears this on its own after 14 and 30 days. Claiming the handle (+50) is the fastest way past it.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim dungvc-devPropose a patch to the maintainer