Skills generate-sparkle-appcast

📦

generate-sparkle-appcast

Name: generate-sparkle-appcast
Author: Caldis

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Generate Sparkle Appcasts for Mos Releases

Publishing Mos updates requires signed appcast files, localized release notes, and matching release assets. This skill automates those release steps from a prepared macOS zip and recent git history.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "generate-sparkle-appcast" from https://skillstore.io/skills/caldis-generate-sparkle-appcast.md and its manifest at https://skillstore.io/api/skills/caldis-generate-sparkle-appcast/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/caldis-generate-sparkle-appcast.md Signed manifest GET /api/skills/caldis-generate-sparkle-appcast/manifest Signed lockfile GET /api/skills/caldis-generate-sparkle-appcast/lockfile

Test it

Using "generate-sparkle-appcast". A stable Mos zip, a valid Sparkle private key, and a previous release commit.

Expected outcome:

A signed appcast file is written to build and docs, with matching Chinese and English release-note pages.

Using "generate-sparkle-appcast". A beta Mos zip with recent user-facing git changes.

Expected outcome:

A beta-channel update item is generated with localized notes and a GitHub release download URL.

Using "generate-sparkle-appcast". Prewritten release-note pages supplied through environment variables.

Expected outcome:

The supplied notes are reused and copied into the publishing directory with matching appcast links.

Security Audit

High Risk

v8 • 7/5/2026 Open versioned report

Most static alerts are false positives from Markdown inline code, quoted shell substitutions, or URLs written into appcast metadata. Real risk remains because the script reads a Sparkle private key, decodes it, writes derived key files, and passes key material through process arguments. The script also allows optional release-note file paths that can copy arbitrary local files into docs/ for publishing.

Files scanned

521

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (7)

High

scripts/generate_appcast.sh:406

Python base64 decode

seed = base64.b64decode(seed_b64)

The base64 decode processes the private Ed25519 seed before creating key material. It is not malware obfuscation, but it is sensitive key handling.

High

scripts/generate_appcast.sh:399

Certificate/key files

key_pem="$tmp_dir/key.pem"

key_pem is the temporary PEM file used to sign the release zip. It contains private signing material and must be treated as sensitive.

High

scripts/generate_appcast.sh:50

Crypto seed/private key mention

[[ -f "$KEY_FILE" ]] || die "Missing Sparkle private key file: $KEY_FILE"

The script refuses to run unless the Sparkle private key file exists. This is intended but confirms direct reliance on private key material.

High

scripts/generate_appcast.sh:392

Crypto seed/private key mention

[[ -n "$key_b64" ]] || die "Sparkle private key file is empty: $KEY_FILE"

The script validates that the private key content read into key_b64 is non-empty. This confirms private key material is loaded into the release script.

High

SKILL.md:18

Crypto seed/private key mention

- Sparkle Ed25519 private key at `sparkle_private_key.txt` (gitignored).

The skill instructions tell users to provide the Sparkle private key at sparkle_private_key.txt. That is a real sensitive asset requirement, not a harmless mention.

High

scripts/generate_appcast.sh:391 scripts/generate_appcast.sh:403-406

Private Key Material Passed Through Process Arguments

The script reads the Sparkle private key into key_b64 and passes it to Python as a command-line argument before decoding it. Local process listings can expose argv values to other same-host users or tooling.

The key is read from sparkle_private_key.txt into key_b64 and then supplied as sys.argv[1] to Python. That is clear evidence of private key material traveling through process arguments.

Medium

scripts/generate_appcast.sh:337-340 scripts/generate_appcast.sh:385-386

User-Controlled Release Note Paths Can Publish Local Files

RELEASE_NOTES_ZH_FILE and RELEASE_NOTES_EN_FILE can point to arbitrary files, and the script copies those files into docs/release-notes by basename. A bad or injected environment value could publish unintended local content.

The environment-controlled source paths are not restricted to build/release-notes before copy. Exploitation requires control of those environment variables, so confidence is high but not absolute.

Capability review items (4)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

scripts/generate_appcast.sh:391

Shell command substitution

key_b64="$(tr -d '\n\r ' <"$KEY_FILE")"

This command substitution invokes tr to read and normalize the Sparkle private key into a shell variable. It is intended for signing, but key material enters shell memory and is security-sensitive.

High

scripts/generate_appcast.sh:410

Python file write/append

open(out_path, "wb").write(der_prefix + seed)

The Python code writes DER-form private key material derived from the Sparkle seed. Writing signing key material to disk is a real secret-handling risk even in a temporary directory.

High

scripts/generate_appcast.sh:7

Generic API/secret keys

KEY_FILE="$ROOT_DIR/sparkle_private_key.txt"

KEY_FILE points to sparkle_private_key.txt at the repository root, and later code reads it for signing. This confirms the skill depends on a local private signing key.

High

SKILL.md:18

Generic API/secret keys

- Sparkle Ed25519 private key at `sparkle_private_key.txt` (gitignored).

The documentation explicitly requires a Sparkle Ed25519 private key file. This is an intended signing dependency but is still sensitive credential handling.

Risk Factors

⚙️ External commands (44)

🌐 Network access (7)

scripts/generate_appcast.sh:10 scripts/generate_appcast.sh:11 scripts/generate_appcast.sh:165 scripts/generate_appcast.sh:447 scripts/generate_appcast.sh:448 scripts/generate_appcast.sh:451 SKILL.md:20

📁 Filesystem access (14)

scripts/generate_appcast.sh:4 scripts/generate_appcast.sh:25 scripts/generate_appcast.sh:196 scripts/generate_appcast.sh:413 scripts/generate_appcast.sh:424 scripts/generate_appcast.sh:425 scripts/generate_appcast.sh:426 scripts/generate_appcast.sh:394 scripts/generate_appcast.sh:394 scripts/generate_appcast.sh:377 scripts/generate_appcast.sh:379 scripts/generate_appcast.sh:410 scripts/generate_appcast.sh:171 scripts/generate_appcast.sh:173

🔑 Env variables (4)

scripts/generate_appcast.sh:210 scripts/generate_appcast.sh:349 scripts/generate_appcast.sh:7 SKILL.md:18

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/caldis-generate-sparkle-appcast/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/caldis-generate-sparkle-appcast/security.svg)](https://skillstore.io/skills/caldis-generate-sparkle-appcast?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/caldis-generate-sparkle-appcast?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caldis-generate-sparkle-appcast/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/caldis-generate-sparkle-appcast.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

Caldis. (2026). generate-sparkle-appcast security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/caldis-generate-sparkle-appcast/audits/8

BibTeX citation

@techreport{caldis-caldis-generate-sparkle-appcast-2026,
  author = {Caldis},
  title = {generate-sparkle-appcast security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/caldis-generate-sparkle-appcast/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "generate-sparkle-appcast security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "Caldis"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/caldis-generate-sparkle-appcast/audits/8"
identifiers:
  - type: other
    value: "skillstore:caldis-generate-sparkle-appcast:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Prepare a Stable Mos Release

Generate the signed appcast and hosted release notes after a notarized stable zip is placed in build/.

Publish a Beta Update Feed

Create beta-channel Sparkle metadata when the release zip uses the documented beta filename format.

Refresh Localized Release Notes

Build Chinese and English release-note pages from git changes since the previous release commit.

Try These Prompts

Generate a Basic Appcast

Generate the Mos Sparkle appcast using the latest zip in build/ and use the previous release commit abc123 as the since commit.

Create a Beta Appcast

Use the generate-sparkle-appcast skill to prepare the beta appcast and localized release notes for the latest Mos beta zip.

Use Existing Release Notes

Generate the appcast with my prewritten Chinese and English release-note HTML files, then copy the final outputs into docs/.

Verify Release Metadata

Generate the appcast, then verify the tag, asset name, version metadata, release-note URLs, and Sparkle signature all match the selected zip.

Best Practices

Run the skill only from the intended Mos release repository.
Keep the Sparkle private key outside version control with strict local permissions.
Confirm the GitHub Release tag and asset name match the generated appcast URL.

Avoid

Do not run the script with an unreviewed zip or unknown signing key.
Do not point release-note file variables at arbitrary local files.
Do not repack or re-sign the zip after generating the Sparkle signature.

Frequently Asked Questions

What does this skill generate?

It generates a Sparkle appcast, localized release-note pages, and a signature for a prepared Mos release zip.

Does it upload files to GitHub?

No. It writes local build and docs files. The GitHub Release asset must still be created separately.

Which release channels are supported?

It supports stable releases and beta releases when the zip filename uses the documented beta format.

Why does it need a private key?

Sparkle uses the Ed25519 key to sign the update zip so clients can verify the download.

Can I use custom release notes?

Yes. You can provide Chinese and English HTML files through environment variables before running the script.

Is this safe to run in any repository?

No. It is tailored to the Mos repository layout and should run only in that trusted release environment.

Developer Details

Author

Caldis

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/Caldis/Mos/tree/master/.codex/skills/generate-sparkle-appcast

Ref

5ab1d37e83436c6eef84de88573e142b94f2a4ad

Maintenance freshness

7/18/2026

Usage

4 downloads · 195 views

File structure

📁 scripts/

📄 generate_appcast.sh

📄 SKILL.md