Skill

utm-release

skill:utmapp/utm#utm-release

Publish a new UTM release on GitHub. Drafts the release notes from the commits and pull requests since the last release, has the user approve them, bumps the version in Build.xcconfig, commits and tags it, pushes, and creates the GitHub release with a discussion in the "Releases" category, which starts the release pipeline. Use this when the user wants to cut, publish, tag, or draft a UTM release or beta, or runs /utm-release.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:43 UTC at 1c5e215

findings

medium

highest severity

threat classes

734

files scanned

1,199/1,204

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/utm-release:.agents/skills/utm-review/SKILL.md:26:HIJACK
suspicious: finding skill:.agents/skills/utm-release:.agents/skills/utm-test/SKILL.md:69:SUPPLY
suspicious: finding skill:.agents/skills/utm-release:.github/workflows/build.yml:293:SUPPLY
suspicious: finding skill:.agents/skills/utm-release:Scripting/UTMScripting.swift:1:DESTRUCT
suspicious: finding skill:.agents/skills/utm-release:Scripting/UTMScripting.swift:1:EXEC
suspicious: finding skill:.agents/skills/utm-release:patches/libsoup-3.6.0.patch:10:SUPPLY
suspicious: finding skill:.agents/skills/utm-release:patches/sources:8:SUPPLY
suspicious: finding skill:.agents/skills/utm-release:scripts/build_dependencies.sh:129:SUPPLY
suspicious: finding skill:.agents/skills/utm-release:scripts/build_utm.sh:94:PRIVESC
suspicious: finding skill:.agents/skills/utm-release:scripts/package.sh:155:PRIVESC
suspicious: finding skill:.agents/skills/utm-release:scripts/package.sh:223:PRIVESC
suspicious: finding skill:.agents/skills/utm-release:scripts/package.sh:259:PRIVESC
suspicious: finding skill:.agents/skills/utm-release:scripts/package.sh:309:PRIVESC

Security findings 13

Agent hijacking

mediumContextual risklow confidence

utm-review and utm-submit instruct the agent to treat AGENTS.md and CONTRIBUTING.md as overriding rule sources at runtime ('overrides default tool behavior', 'single source of truth', 'those files *are* the checklist'), but neither file is consumed by the artifact, so the instructions the agent will obey there cannot be reviewed.

.agents/skills/utm-review/SKILL.md:26-32

AGENTS.md` overrides default tool behavior for this repo

vector:instruction

Counter-argument considered

The skill really does direct the agent to obey AGENTS.md/CONTRIBUTING.md at runtime as overriding rule sources, and neither file is shipped in any shown unit, so the instructions the agent will follow there are unreviewable; the deference is openly declared, but declaration is not a carve-out for applying unshipped instruction content.

Supply chain

mediumContextual risklow confidence

The utm-test skill instructs the agent to download prebuilt dependency frameworks from an unpinned source ('a recent GitHub Actions run') and extract them at the repo root, where they are embedded into and loaded by the app under test; the source is the project's own CI, so the chain's risk depends on that provenance.

.agents/skills/utm-test/SKILL.md:69-70

GitHub Actions run and extract them at the repo root.

vector:instruction

Counter-argument considered

The instruction to pull Sysroot artifacts from an unpinned 'recent GitHub Actions run' and extract at the repo root is real, and the downloaded sysroot frameworks are embedded into and loaded by the app under test; the behavior is declared, but disclosure does not pin the provenance, so the supply exposure stands.

Supply chain

mediumContextual risklow confidence

The release workflow passes signing certificate data, its password, and a personal access token into third-party GitHub Actions pinned only to mutable version tags (apple-actions/import-codesign-certs@v1, peter-evans/repository-dispatch@v1) rather than commit SHAs, so the code handling these secrets can silently change upstream.

.github/workflows/build.yml:293-323

uses: apple-actions/import-codesign-certs@v1

vector:code

Counter-argument considered

The workflow verifiably passes the PKCS#12 signing certificate, its password, and PERSONAL_ACCESS_TOKEN into apple-actions/import-codesign-certs@v1 and peter-evans/repository-dispatch@v1 pinned only to mutable tags, so the code handling these secrets can change upstream; no pinning or mitigation appears in the shown evidence.

Supply chain

mediumContextual risklow confidence

This artifact ships an undeclared patch that makes libsoup's public-suffix (TLD) cookie rejection conditional on libpsl being present, so a build without libpsl would accept cookies for public-suffix domains under the ALWAYS accept policy, weakening cookie isolation in the built application whenever that configuration is used.

patches/libsoup-3.6.0.patch:10

We no longer reject cookies for public domains

trigger:conditionalvector:code

Counter-argument considered

The code reading is correct: the #else branch makes the public-suffix rejection conditional so that under ACCEPT_ALWAYS a libpsl-less build accepts public-suffix cookies, weakening cookie isolation; the commit message discloses the tradeoff, but disclosure does not restore the isolation and no other mitigation is shown.

Supply chain

mediumContextual risklow confidence

The build sources file consumed by the release pipeline directs downloads of dependency source code from version-pinned but unhashed upstream URLs, two over plain HTTP, so tampered code could be compiled into shipped UTM release artifacts.

patches/sources:8

ICONV_SRC=

vector:code

Counter-argument considered

The consumed sources file pins versions but no hashes and fetches libiconv, gettext, and libxml2 over plain HTTP, so tampered dependency code could reach compilation into shipped artifacts; the network fetches are additionally flagged as undeclared residue.

Destructive action

mediumContextual risklow confidence

UTM's AppleScript scripting interface exposes virtual machine deletion and snapshot deletion that erase all data without any confirmation, so a local process permitted to script UTM can destroy user data.

Scripting/UTMScripting.swift:1-320

Delete a virtual machine. All data will be deleted, there is no confirmation!

vector:code

Counter-argument considered

The shipped scripting interface verbatim exposes VM deletion and snapshot deletion whose data is erased without confirmation, and the finding already concedes the macOS automation-permission boundary; nothing in the evidence turns this into a carve-out or neutralizes the destructive exposure.

Code execution

mediumContextual risklow confidence

UTM's AppleScript scripting interface exposes command execution on guests plus guest-to-host and host-to-guest file transfer, giving any local scripting client a channel to run commands inside virtual machines.

Scripting/UTMScripting.swift:1-320

Execute a command or script on the guest.

vector:code

Counter-argument considered

The interface really exposes guest command execution plus guest-to-host and host-to-guest file transfer in its AppleScript dictionary; it is self-documented product functionality and no evidence establishes a carve-out or mitigation, so the accurate contextual claim stands.

Supply chain

mediumContextual riskhigh confidence

The release pipeline's undeclared dependency build script downloads dozens of dependency source tarballs from URLs loaded at runtime from patches/sources via curl with no checksum or signature verification shown, so any non-upstream or mutable source URL would inject unreviewed code into everything the release pipeline builds.

scripts/build_dependencies.sh:129

retry curl -f -L -O

vector:code

Counter-argument considered

Kill case fails: the tarball URLs are version-pinned upstream addresses and the downloads are cached, but nothing in the shown code verifies checksums or signatures and no carve-out (the URLs are not a pinned official-registry install) or declared claim (the description covers only drafting/tagging/publishing the release) covers fetching and compiling remote sources. Live case holds: the shipped script sources its URL list at runtime, curls dozens of tarballs (several over plain HTTP) with no integrity check, and configures/makes them into the sysroot the release app links, an undeclared source-to-sink supply chain that nothing in the artifact neutralizes.

Privilege escalation

mediumContextual risklow confidence

The release archive build disables Xcode's verification gate for SwiftPM package plugins via -skipPackagePluginValidation (alongside CODE_SIGNING_ALLOWED=NO), allowing unvalidated plugin code from dependencies to run during the build without confirmation.

scripts/build_utm.sh:94

-skipPackagePluginValidation CODE_SIGNING_ALLOWED=NO

vector:code

Counter-argument considered

Kill case fails: -skipPackagePluginValidation is a documented, widely used CI flag, but documented practice is not a listed carve-out and it concretely skips Xcode's trust confirmation for package plugins in the build that produces the release archive; no declared claim or the declared description covers build-time plugin validation being bypassed. Live case holds: the script's own comment acknowledges package build plugins run as host tools during this xcodebuild invocation, connecting dependency plugin code to unvalidated build-time execution.

Privilege escalation

infoContextual riskmedium confidence

The iOS deb packaging declares a dependency on AppSync Unified (net.angelxwind.appsyncunified), a code-signing enforcement bypass on jailbroken iOS, so the shipped package's ldid-forged signatures and entitlements are made effective by disabling the platform's signature checks.

scripts/package.sh:155

Depends: firmware (>=15.0), net.angelxwind.appsyncunified

vector:code

Counter-argument considered

The Depends line is verbatim in the deb control template and no declaration (D2/D32/D67 or the release description) or carve-out covers shipping a dependency whose effect is bypassing iOS signature enforcement, so the finding stands as contextual risk; however, nothing shown directs the agent to read or run scripts/package.sh, so reach and chain fail only by absence, which lowers severity without refuting.

Privilege escalation

infoContextual riskmedium confidence

The packaging script writes a forged entitlements plist granting Apple-private capabilities (com.apple.private.hypervisor, com.apple.vm.device-access, dynamic-codesigning, get-task-allow, IOKit user clients) and applies it to the distributed app binary via ldid -S, bypassing normal entitlement provisioning.

scripts/package.sh:223

<key>com.apple.private.hypervisor</key>

vector:code

Counter-argument considered

The script verbatim writes a plist granting com.apple.private.hypervisor, com.apple.vm.device-access, dynamic-codesigning and IOKit user clients and applies it to the shipped binary via ldid -S, none of which is declared by any claim or covered by a carve-out, so the finding stands; the only imprecision is that get-task-allow belongs to the sibling ipa-mode plist rather than the line-223 deb-mode plist, but the quoted key and the application mechanism mean exactly what the claim says. No shown evidence has the agent reading or running the script, so reach and chain fail by absence only.

Privilege escalation

infoContextual risklow confidence

scripts/package.sh embeds a fake entitlements plist granting get-task-allow and com.apple.private.hypervisor (plus memorystatus and IOKit user-client access) that is applied to the re-signed UTM IPA via create_fake_ipa, giving the packaged app debugger and hypervisor privileges on the target device.

scripts/package.sh:259

<key>com.apple.private.hypervisor</key>

vector:code

Counter-argument considered

The ipa-mode plist verbatim grants get-task-allow, com.apple.private.hypervisor, memorystatus and IOKit user-client access and is passed to create_fake_ipa, and no declared claim covers this behavior, so the finding stands as contextual risk; nothing shown instructs the agent to read or execute package.sh and no agent-controlled input reaches the plist, so reach and chain fail by absence, which does not refute.

Privilege escalation

infoContextual risklow confidence

scripts/package.sh embeds a fake entitlements plist for the ipa-hv re-signing path granting com.apple.private.security.no-sandbox, private storage access to AppDataContainers and MobileDocuments, and platform-application, which would strip sandbox protections from the packaged app.

scripts/package.sh:309

<key>com.apple.private.security.no-sandbox</key>

vector:code

Counter-argument considered

The ipa-hv plist verbatim grants com.apple.private.security.no-sandbox, com.apple.private.security.storage.AppDataContainers/MobileDocuments and platform-application and is applied via create_fake_ipa, undeclared by any claim and outside every carve-out, so the finding stands as contextual risk; no evidence connects the agent to reading or running the script, so reach and chain fail by absence only, which never refutes.

Open questions 34

What the analysis could not settle from the code alone.

Detector leads PY-CLAIM-CONTRADICTION pair the release-notes writing guideline 'Leave out changes users can't see' (Documentation/Release.md) with file writes in scripts/package.sh, scripts/package_mac.sh, and scripts/build_dependencies.sh, none of which are shown in this batch; the quoted guideline concerns release-notes content, so confirm these leads are spurious matches against build scripts rather than a real integrity mismatch.

patches/sources labels one dependency 'Decompiled Hypervisor for iOS' (reverse-engineered Apple code built into release artifacts); no listed capability class covers this provenance/licensing question, and no shown text declares it.

SettingsView.swift contains a developer comment stating it is 'okay to store the server password in plaintext in the settings plist'; this is UTM application behavior, not behavior of the utm-release skill itself, so it does not appear to be an undeclared capability of this agent artifact — confirm whether plaintext server-password storage in the repository is in scope for this skill's declared-vs-actual assessment.

Credential access

Does the SPICE server password stored in plaintext in the settings plist (per the code comment) ever leave the host through sync, backup, or logs?

Credential access

Are the github.com/utmapp, github.com/osy, and gitlab.freedesktop.org/osy fork URLs in patches/sources the project's official maintained sources for these build dependencies?

Supply chain

The PY-CLAIM-CONTRADICTION detector leads quote a claim ('- **Leave out** changes that users can't see: docs, CI, agent skills, tests, refactors, and build s…') that is not present in any reviewed unit; confirm where that release-notes guidance lives and whether it instructs omitting security-relevant changes from published release notes.

Manipulation

The EXFIL detector leads treat 'http://www.apple.com/DTDs/PropertyList-1.0.dtd' as a network capability; the reviewed units show it only as the standard inert plist DOCTYPE declaration in heredocs, with no fetch logic, but confirm no other code in package.sh performs network requests.

[file request AGENTS.md] utm-release, utm-review, and utm-submit instruct the agent to read AGENTS.md and state that it 'overrides default tool behavior for this repo' (commit-trailer policy). Does AGENTS.md contain directives that steer the agent beyond commit/attribution policy, such as instruction overrides, secrecy, or data access beyond the declared task?

Agent hijacking

[file request CONTRIBUTING.md] utm-review and utm-submit treat CONTRIBUTING.md as the authoritative checklist the agent must audit against. Does CONTRIBUTING.md stay within contribution guidelines or does it contain directives that push the agent beyond the declared review/submit task?

Agent hijacking

[file request scripts/install_d3dmetal.sh] build.yml invokes ./scripts/install_d3dmetal.sh with a URL taken from secrets/vars (D3DM_DIST_DMG_URL). Does this script fetch and mount/execute remote content without pinning or verification?

Supply chain

[file request scripts/fixup.sh] utm-test instructs running 'scripts/fixup.sh -p macos -s sysroot-macos-arm64 <lib>' to repackage dylibs into frameworks, rewriting install names and imports in place. What paths does the script modify, and does it execute or download anything beyond local install-name/signing tooling?

Code execution

[file request scripts/install_d3dmetal.sh] The release pipeline runs this script with a DMG URL taken from secrets/vars (D3DM_DIST_DMG_URL). Does it download content from that URL, verify it, and install or execute it, and is the source validated in any way?

Supply chain

[file request qemu/build_dependencies.sh] Which dependency patches under patches/ are applied to which libraries and with which build flags; specifically, is libsoup built without libpsl so that HAVE_TLD is undefined and the relaxed public-suffix cookie handling in patches/libsoup-3.6.0.patch becomes active, and is the glib subproject wrap (pcre sourceforge URL) actually used for downloads?

Supply chain

[file request scripts/build_dependencies.sh] When build_dependencies.sh downloads the patches/sources tarballs, does it verify checksums or signatures, and are the cleartext http:// URLs (ftp.gnu.org, xmlsoft.org) upgraded to https before fetching?

Supply chain

[file request scripts/install_d3dmetal.sh] What does the D3DMetal private-import rebinding mentioned in the build script comments do, and does install_d3dmetal.sh download or execute remote code during the release/build flow?

Supply chain

[file request patches/sources] Do the *_SRC tarball URLs and *_REPO git URLs consumed by download_all/clone point to official upstream projects at pinned versions (with any integrity verification), or do any point to forks, mirrors, or mutable refs?

Supply chain

[file request scripts/build_dependencies.sh] utm-test tells the agent to run ./scripts/build_dependencies.sh to build all native dependencies; does the script download or execute anything beyond the pinned sources recorded in patches/sources and patches/*.patch, or touch credentials or network destinations outside those pinned sources?

Code execution

[file request scripts/install_d3dmetal.sh] The release CI passes a secret-or-variable URL (D3DM_DIST_DMG_URL) to this script; what does it download, from where, and does it mount or execute the DMG content?

Supply chain

[file request scripts/build_dependencies.sh] Do the download and clone paths verify archives or checkouts against checksums or signatures before extraction, patching, and building, and is any fetched code executed on the host build machine?

Supply chain

[file request scripts/install_d3dmetal.sh] What does install_d3dmetal.sh download and rebind with install_name_tool, and does it fetch or execute any code from remote sources?

Supply chain

[file request scripts/install_d3dmetal.sh] How is the user-supplied dmg-url processed (downloaded or mounted) and is patch_d3dmetal_imports.py executed on the host; does any fetched content reach execution?

Code execution

[file request scripts/build_dependencies.sh] How are the dependency sources ($FFI_SRC, $GETTEXT_SRC, repo checkouts such as depot_tools.git) obtained in the unseen sections — are they pinned, and is any fetched content executed?

Supply chain

[file request scripts/build_dependencies.sh] How is d3dmetal-native (the provider framework and its patch_d3dmetal_imports.py invoked by install_d3dmetal.sh) obtained - in-repo path, submodule, or remote fetch - and is that source pinned or verified?

Supply chain

[file request patches/glib-2.83.0.patch] build_dependencies.sh applies patches by tarball name (glib-2.83.0.tar.xz would need patches/glib-2.83.0.patch), so does that patch exist and what does it change — in particular is the pcre subproject wrap URL change (sourceforge) from the shown glib-2.69.0.patch active for the glib actually built?

Supply chain

[file request QEMULauncher/QEMULauncher.entitlements] Does QEMULauncher.entitlements, copied by package_mac.sh into the ad-hoc re-signed QEMULauncher binary, contain anything beyond UTM's standard entitlements (for example no-sandbox, com.apple.security.cs.* allow-jit or disable-library-validation exceptions, com.apple.private.*, or temporary-exception keys)?

Privilege escalation

[file request QEMURenderServer/QEMURenderServer.entitlements] Does QEMURenderServer.entitlements, copied by package_mac.sh into the ad-hoc re-signed QEMURenderServer binary, contain anything beyond UTM's standard entitlements (for example no-sandbox, com.apple.security.cs.* exceptions, com.apple.private.*, or temporary-exception keys)?

Privilege escalation

[file request QEMUHelper/QEMUHelper.entitlements] Does QEMUHelper.entitlements, copied by package_mac.sh into the ad-hoc re-signed QEMUHelper XPC service, contain anything beyond UTM's standard entitlements (for example no-sandbox, com.apple.security.cs.* exceptions, com.apple.private.*, or temporary-exception keys)?

Privilege escalation

[file request utmctl/utmctl.entitlements] Does utmctl.entitlements, copied by package_mac.sh and sed-rewritten before the ad-hoc re-signing of utmctl, contain anything beyond UTM's standard entitlements (for example no-sandbox, scripting or automation targets beyond the UTM app itself, com.apple.private.*, or temporary-exception keys)?

Privilege escalation

[file request .github/workflows/build.yml] What DMG URL or path is passed to scripts/install_d3dmetal.sh at its call site, and is it a pinned or official Apple distribution source?

Supply chain

[file request scripts/build_dependencies.sh] Where is $BUILD_DIR/depot_tools.git cloned or fetched (from which URL and commit) before build_angle and build_hypervisor prepend it to PATH?

Supply chain

[file request deb/postinst.m] What does the Debian post-install maintainer script compiled into the released UTM .deb execute on the end-user device at install time?

Code execution

[file request deb/prerm.m] What does the Debian pre-removal maintainer script compiled into the released UTM .deb execute on the end-user device at package removal time?

Code execution

[file request d3dmetal-native/patch_d3dmetal_imports.py] Does patch_d3dmetal_imports.py, which install_d3dmetal.sh runs against the downloaded D3DMetal binary, only rebind the documented private-API imports and refuse unexpected binaries, or does it modify anything else?

Code execution

[file request AGENTS.md] utm-release and utm-submit direct the agent to follow AGENTS.md for commit format and AI attribution; does AGENTS.md contain any instruction that overrides agent behavior, demands secrecy from the user, or redirects actions beyond commit/PR format and attribution?

Agent hijacking

Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Credential access

criticalRefutedlow confidence

Documentation/Release.md instructs exporting signing certificates together with their private keys from the macOS Keychain into base64-encoded repository secrets, so an agent following the release guide handles keychain private-key material, though the disclosed destination is the repository's own GitHub Actions secrets.

Documentation/Release.md:169

must be exported from Keychain as a PKCS#12 file

Why it was refuted

The Keychain export targets the repository's own GitHub Actions secrets exactly as declared for signing the release pipeline (secrets table and workflow both declare SIGNING_CERTIFICATE_P12_DATA 'for signing'), which is the declared core-capability flow with a disclosed destination, not an undeclared credential channel.

Supply chain

highRefutedlow confidence

This artifact ships a glib dependency patch that retargets the pcre source download URL from the official ftp.pcre.org to sourceforge.net, an undeclared dependency-source redirection beyond the release-publishing purpose that is mitigated but not justified by the retained source_hash pin.

patches/glib-2.69.0.patch:19

source_url = https://sourceforge.net/projects/pcre/files/pcre/8.37/pcre-8.37.tar.bz2

Why it was refuted

The retarget is a documented upstream fix for the dead official host ('ftp.pcre.org FTP site is no longer available') and retains the identical SHA-256 source_hash pin, so the downloaded content remains byte-verified and no tampered source can enter; the patch header openly declares the change and its reason, leaving no undeclared redirection risk.

Coverage gaps 93

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-Linux.imageset/linux.pdf

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-Windows.imageset/windows.pdf

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-macOS.imageset/macos.pdf

context:unanalyzable_binary binary content is only byte-scanned

scripts/resources/UTM-drive.icns

frontmatter_unparseable while parsing a block mapping

.claude/commands/utm-release.md