Versioned security assessment

Report ID: SA-84AEFA7A

8/21/2026, 8:36:45 AM

limrun-ios-simulator security assessment v1

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: codex Latest published report
Skill name
limrun-ios-simulator
Version
v1
Maintainer
limrun-inc
Source
github.com/limrun-inc/skills/tree/e29a129cea3d311d2bd348eef1aadcd1b20397d5/skills/limrun-ios-simulator
Coverage
1 Files scanned · 315 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Highest confirmed finding severity

Medium

3 confirmed security findings require attention.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

All 113 static alerts are false positives caused by Markdown, documented CLI operations, normal temporary output, and benign credential references. The skill still requires safeguards for global package installation, cloud artifact uploads, and signed simulator links.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 315 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 2 evidence locations

Filesystem access

May read or write local files.

Observed in 1 evidence location

Env variables

May read values from the process environment.

Observed in 1 evidence location

External commands

May invoke commands or programs outside the Skill.

Observed in 50 evidence locations

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 Medium
SKILL.md:20
Unpinned Global Package Installation
The skill directs agents to install the latest lim package globally. A mutable package version can change host-wide behavior without review.
Line 20 explicitly uses a global npm installation without a version pin or integrity check.
RISK-002 Medium
SKILL.md:72-76SKILL.md:267-276
Local App Artifacts Uploaded to a Cloud Service
The skill uploads local app bundles and assets to Limrun. These files may contain proprietary code or embedded configuration and require informed user consent.
The cited commands explicitly upload local app bundles or named assets to the Limrun cloud service.
RISK-003 Medium
SKILL.md:50-58SKILL.md:68-70
Signed Simulator Access Links Shared in Chat
The skill instructs agents to share signed simulator URLs. Anyone receiving a valid link may gain access to the live app session.
The text explicitly describes the URL as signed and directs the agent to share it for live simulator access.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    The installation command uses an unpinned global npm package.
    Pin an audited lim version and request approval before installation. Prefer a project-scoped package or verified package runner when supported.
  2. FIX-002
    Medium
    Local app bundles and assets are uploaded to Limrun.
    Require explicit consent before every upload. State the destination and selected path, then check artifacts for secrets and production data.
  3. FIX-003
    Medium
    Signed simulator links provide session access.
    Treat signed URLs as credentials. Share them only with the requesting user, avoid logs, and document expiration or revocation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
84aefa7a7e7c02de023284b80e4d38327869e4be
Content hash
904645ba73253269e720b0bfb8c60551c13bf110087b663ed1ab51ea71ea41e8
Tree hash
75fcb7b7802ccdc1f19a1f89ba90f9b5e3028fc551339f888cd27a9024932158
Skill path
skills/limrun-inc/limrun-ios-simulator
Audit payload hash
249baa92a04406c88fece1cae0cd0c2d

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active