Skill

utm-submit

skill:utmapp/utm#utm-submit

Submit the current UTM change as a pull request to github.com/utmapp/UTM. Ensures /utm-review has run, then either updates an existing PR (squashing each new edit into the commit that owns it and force-pushing) or opens a new PR (gathering issue links and a human-testing attestation). Use this when the user wants to submit, open, update, or push a UTM pull request, or runs /utm-submit.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 21:48 UTC at 1c5e215

findings

high

highest severity

threat classes

734

files scanned

1,202/1,204

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.agents/skills/utm-submit:Platform/macOS/SettingsView.swift:505:CRED
suspicious: finding skill:.agents/skills/utm-submit:Scripting/UTMScripting.swift:250:DESTRUCT
suspicious: finding skill:.agents/skills/utm-submit:Scripting/UTMScripting.swift:262:EXEC
suspicious: finding skill:.agents/skills/utm-submit:patches/sources:8:SUPPLY
suspicious: finding skill:.agents/skills/utm-submit:scripts/build_dependencies.sh:27:SUPPLY
suspicious: finding skill:.agents/skills/utm-submit:scripts/build_dependencies.sh:69:EXEC
suspicious: finding skill:.agents/skills/utm-submit:scripts/build_dependencies.sh:857:SUPPLY
suspicious: finding skill:.agents/skills/utm-submit:scripts/build_utm.sh:94:PRIVESC
suspicious: finding skill:.agents/skills/utm-submit:scripts/install_d3dmetal.sh:8:SUPPLY
suspicious: finding skill:.agents/skills/utm-submit:scripts/package.sh:223:PRIVESC
suspicious: finding skill:.agents/skills/utm-submit:scripts/package.sh:309:PRIVESC

Security findings 11

Credential access

highContextual riskmedium confidence

UTM's macOS settings view deliberately stores the remote-session server password in plaintext in the settings plist, leaving that credential readable by any process running as the same user.

Platform/macOS/SettingsView.swift:505-513

store the server password in plaintext in the settings plist

Decoded

note it is okay to store the server password in plaintext in the settings plist because if the attacker is able to see the password, they can gain execution in UTM application context... which is the context needed to read the password.

vector:code

Counter-argument considered

Stands: the server password is bound via @AppStorage, i.e. stored in the plaintext UserDefaults plist, and the inline comment is a threat-model rationale, not a mitigation — disclosure is not a carve-out — while no declared claim covers credential storage.

Destructive action

highContextual risklow confidence

The UTM AppleScript scripting interface exposes VM deletion and macOS IPSW installation that erase all VM or primary-drive data with no confirmation prompt, so any process holding automation rights to UTM can destroy VM data silently.

Scripting/UTMScripting.swift:250-260

Delete a virtual machine. All data will be deleted, there is no confirmation!

vector:code

Counter-argument considered

Stands: the shipped scripting interface genuinely exposes VM deletion and IPSW installation with no confirmation, no carve-out or mitigation is shown, no declared claim covers it, and the review workflow explicitly reads this generated file.

Code execution

highContextual risklow confidence

The UTM AppleScript interface lets any automation-authorized caller execute commands on a running guest, fetch the results, and pull guest files to the host, turning scripting access into remote code execution and data retrieval inside the VM.

Scripting/UTMScripting.swift:262-270

Execute a command or script on the guest.

vector:code

Counter-argument considered

Stands: the shipped interface exposes guest command execution with result fetching and guest-to-host file pull, turning scripting access into in-guest code execution and data retrieval; no carve-out applies and no shown evidence neutralizes it.

Supply chain

mediumContextual riskmedium confidence

The dependency URL list consumed by scripts/build_dependencies.sh (whose comment '# Include URL list' confirms it is sourced) fetches upstream source tarballs by mutable URL with no content hashes, including plain-HTTP sources such as ftp.gnu.org and xmlsoft.org, so a tampered or MITM-substituted download becomes code executed at build time.

patches/sources:8-27

ICONV_SRC=

vector:code

Counter-argument considered

Strongest counter: this is the repository's ordinary OSS build process and most URLs are HTTPS upstreams, which only lowers severity; no carve-out covers tarball fetches pinned by version-in-URL with no content hashes, plain-HTTP entries exist, the script curls them with no checksum verification then extracts, patches, configures and makes the downloaded code, and no declared claim covers these hosts, so the supply-chain finding survives.

Supply chain

mediumContextual risklow confidence

The artifact ships scripts/build_dependencies.sh, an undeclared cross-compilation build pipeline whose network fetch/retry configuration shows it downloads external sources at build time, a capability the skill's declared PR-submission purpose does not declare.

scripts/build_dependencies.sh:27

# Network operations are retried because concurrent builds on the same CI runner

vector:code

Counter-argument considered

Not refuted: the shipped script really does fetch external sources over the network with retry/backoff and then unpacks and executes fetched build code, a supply behavior that falls outside every accepted carve-out and is nowhere covered by the skill's declared PR-submission purpose; the low-confidence contextual_risk disposition is consistent with the evidence.

Code execution

mediumContextual riskmedium confidence

The repository build script scripts/build_dependencies.sh shipped alongside the utm-submit skill executes dynamic Python via `python3 -c `import $1`` as a dependency preflight check, an exec capability that is undeclared by the skill's stated PR-submission purpose (adjudicated unexplained: the purpose does not need it, nothing conceals it, and it is called only with fixed module names six, pyparsing, distutils, yaml, distlib, mako, so it is not harmful on its face).

scripts/build_dependencies.sh:69

python3 -c

vector:code

Counter-argument considered

Not refuted: the undeclared dynamic exec exists exactly as claimed and the PY-CLAIM-RESIDUE lead confirms it is declared nowhere; every shown call site passes a fixed module name (six, pyparsing, distutils, yaml, distlib, mako), so the only gate that fails is chain, and that failure is an absence claim which cannot refute and merely matches the finding's own contextual_risk framing.

Supply chain

mediumContextual riskmedium confidence

build_dependencies.sh executes the fetchDependencies script from the cloned MoltenVK tree, running fetched third-party code (which itself fetches further dependencies) during the dependency build.

scripts/build_dependencies.sh:857

env -i PATH=$PATH HOME=$HOME LANG=en_US.UTF-8 ./fetchDependencies --$MVK_PLATFORM -v

vector:code

Counter-argument considered

build_moltenvik runs ./fetchDependencies out of the cloned MoltenVK.git tree (after pushd "$BUILD_DIR/MoltenVK.git"), and clone_moltenvk_dependences already executes the same fetched in-tree script with --none; executing fetched third-party build code is not a listed carve-out, is absent from the skill's PR-submission-only description, and the clone→cd→execute chain is concrete, so the finding stands.

Privilege escalation

mediumContextual risklow confidence

build_utm.sh passes -skipPackagePluginValidation to xcodebuild, disabling Xcode's validation gate so SwiftPM package plugins execute during the build without the usual confirmation.

scripts/build_utm.sh:94

-skipPackagePluginValidation

vector:code

Counter-argument considered

The xcodebuild archive invocation literally carries -skipPackagePluginValidation, which lets SwiftPM package plugins in the package graph execute during the archive without the usual validation gate; nothing in the artifact mitigates or declares this (the skill only declares PR submission), so the flag stands as an undeclared build-time supply-chain weakening.

Supply chain

mediumContextual risklow confidence

install_d3dmetal.sh accepts an arbitrary caller-supplied DMG URL and installs, binary-patches (identifier rewrite and import rebinding), and ad-hoc-signs D3DMetal.framework from it into the sysroot embedded in the distributed app, so an unpinned or attacker-chosen URL can inject native code into the product.

scripts/install_d3dmetal.sh:8

either a URL or a local path.

vector:code

Counter-argument considered

The script accepts an arbitrary caller-supplied dmg-url, curls and mounts it, ditto-copies D3DMetal.framework into the sysroot, binary-patches its identifier/imports and ad-hoc re-signs it; the structural checks (identifier length, patcher refusal of unexpected frameworks) authenticate nothing about the DMG's origin, so the unpinned-URL native-code injection risk is real and undeclared by the PR-submission skill.

Privilege escalation

mediumContextual riskmedium confidence

package.sh fabricates private Apple entitlements (com.apple.private.hypervisor, dynamic-codesigning, IOKit user-client exceptions, com.apple.vm.device-access, get-task-allow) into a fake-signed IPA/deb whose Debian control file depends on the code-signature-bypass package AppSync Unified, producing an entitlement-escalated app distributed outside Apple's provisioning system.

scripts/package.sh:223

com.apple.private.hypervisor

vector:code

Counter-argument considered

The deb branch writes a FAKEENT plist containing com.apple.private.hypervisor, dynamic-codesigning, IOKit user-client exceptions and com.apple.vm.device-access (the ipa branch adds get-task-allow), fake_sign applies it via ldid to the app binary, and the Debian control declares Depends on net.angelxwind.appsyncunified (AppSync Unified) exactly as claimed; no carve-out applies and the PR-submission skill declares none of this packaging.

Privilege escalation

mediumContextual riskmedium confidence

The ipa-hv packaging branch in scripts/package.sh embeds com.apple.private.security.no-sandbox, com.apple.private.security.storage.AppDataContainers, com.apple.private.security.storage.MobileDocuments and platform-application entitlements into the forged plist, giving the packaged app a sandbox escape with access to other apps' containers and the user's documents.

scripts/package.sh:309

<key>com.apple.private.security.no-sandbox</key>

vector:code

Counter-argument considered

The ipa-hv branch opened by 'ipa-hv )' embeds com.apple.private.security.no-sandbox, storage.AppDataContainers, storage.MobileDocuments and platform-application into FAKEENT and routes it through create_fake_ipa → fake_sign → ldid into the distributed IPA, matching the claim; the behavior is undeclared by the PR-submission skill and no carve-out or mitigation applies.

Open questions 25

What the analysis could not settle from the code alone.

The skill's own instruction file is not in this batch: whether the declared PR-submission workflow instructs running scripts/build_dependencies.sh (which consumes patches/sources) cannot be settled from the shown units; if it does, residue R1-R22 would move toward necessary.

Supply chain

patches/sources and scripts/build_dependencies.sh ship paired decoded views whose recovered text is a comment-only skeleton; the encoding or hidden channel that produced these decoded units is not shown, and the recovered text itself is benign (section comments only, no code or URLs).

Whether the Sysroot-* GitHub Actions artifacts that utm-test instructs the agent to download and extract at the repo root are integrity-checked before their frameworks are embedded into the built app.

Supply chain

The build.yml decoded units are partial windows over one 516-line file; workflow portions not covered by any shown window were not reviewed in this pass.

Whether the third-party build steps (MoltenVK ./fetchDependencies, mesa/depot_tools/d3dmetal checkouts) run against pinned revisions or mutable upstream state cannot be determined from the shown ranges of build_dependencies.sh.

Supply chain

Whether the deb/ipa artifacts built by package.sh (fabricated private entitlements plus AppSync Unified signature-bypass dependency) are distributed by this skill or only built locally on demand.

Privilege escalation

[file request scripts/build_dependencies.sh] In the unshown portion of this build script, does it download the patches/sources URLs and execute the fetched code (untar plus configure/make/cmake of tarballs and git clones), and does anything write outside the build tree or read credentials?

Supply chain

[file request patches/sources] Do the *_SRC download URLs and *_REPO clone URLs defined in this file pin exact versions/commits, point to official upstream hosts, and declare any checksum verification for the tarballs fetched by the download() function?

Supply chain

[file request scripts/build_dependencies.sh] utm-test instructs the agent to run scripts/build_dependencies.sh, which deletes the sysroot before building: does it fetch dependency sources only from the URLs pinned in patches/sources and execute nothing unpinned?

Supply chain

[file request scripts/install_d3dmetal.sh] The release workflow passes a secrets/vars-controlled URL to this script which installs a DMG into the release sysroot: does it verify the download (checksum/signature) before installing it into artifacts that ship to users?

Supply chain

[file request scripts/install_d3dmetal.sh] When dmg-url is a remote URL, how is the DMG downloaded (which tool, which default URL, where staged) and what is executed or copied from the mounted image before the in-place patching, import rebinding, and signing?

Supply chain

[file request AGENTS.md] Does AGENTS.md contain any directives to the agent beyond attribution/commit formatting, e.g. secrecy, confirmation bypasses, extra commands, or text aimed at agents or reviewers?

Agent hijacking

[file request CONTRIBUTING.md] Does CONTRIBUTING.md contain any directive that steers the agent beyond commit/PR policy (secrecy, extra tool calls, or reviewer-directed text)?

Agent hijacking

[file request patches/sources] Do the tarball URLs and git repos/commits in this source list point to official upstream hosts with pinned versions?

Supply chain

[file request CONTRIBUTING.md] utm-submit instructs the agent to read CONTRIBUTING.md as governing commit/PR format and the attribution policy it enforces (Assisted-by trailer, no Co-authored-by): does CONTRIBUTING.md contain instructions beyond commit format and attribution that the agent would follow during submission?

Agent hijacking

[file request patches/sources] Which URLs and commits do FFI_SRC, GETTEXT_SRC, MESA_REPO, DXMT_REPO, MOLTENVK_REPO, D3DMETAL_REPO, LLVM15_SRC and the other clones use: are tarball URLs version-pinned HTTPS archives and are all repos checked out at fixed commits, and is any checksum verification defined for the downloads?

Supply chain

[file request scripts/deb/postinst.m] What does the UTM .deb postinst hook execute on the device at package install time — any network access, writes outside the app container, or privileged operations?

Code execution

[file request scripts/deb/prerm.m] What does the UTM .deb prerm hook execute on the device at package removal time — any network access, writes outside the app container, or privileged operations?

Code execution

[file request AGENTS.md] utm-review and utm-submit instruct the agent to read AGENTS.md and state that it 'overrides default tool behavior for this repo' (commit-trailer policy). Does AGENTS.md contain any directives to the agent beyond attribution/commit formatting, e.g. secrecy, confirmation bypasses, extra commands, or text aimed at agents or reviewers?

Agent hijacking

[file request CONTRIBUTING.md] utm-review uses CONTRIBUTING.md as its audit checklist and utm-submit inlines its attribution policy; does CONTRIBUTING.md contain any directive that steers the agent beyond commit/PR policy (secrecy, extra tool calls, or reviewer-directed text)?

Agent hijacking

[file request scripts/deb/postinst.m] What actions does the postinst script compiled into the UTM deb perform when the package is installed?

Code execution

[file request scripts/deb/prerm.m] What actions does the prerm script compiled into the UTM deb perform before package removal?

Code execution

[file request AGENTS.md] utm-submit reads AGENTS.md first and writes the attribution trailer it requires into commits: does AGENTS.md contain instructions beyond commit/PR format and attribution that the agent would follow during submission?

Agent hijacking

[file request deb/postinst.m] What does the postinst hook compiled into the UTM .deb (xcrun clang postinst.m -o $DEB_TMP/DEBIAN/postinst) execute on the device at package install time?

Code execution

[file request deb/prerm.m] What does the prerm hook compiled into the UTM .deb (xcrun clang prerm.m -o $DEB_TMP/DEBIAN/prerm) execute on the device at package removal time?

Code execution

Refuted findings 6

Candidates the review stage examined and rejected, kept for transparency.

Persistence

criticalRefutedlow confidence

The iOS-simulator steps in utm-test write the UTM app default ReleaseNotesLastVersion inside a disposable simulator to suppress the What's-New dialog — an undeclared host-config write to app defaults, though confined to the simulator environment used by the declared testing workflow.

.agents/skills/utm-test/SKILL.md:329

xcrun simctl spawn $UDID defaults write com.utmapp.UTM ReleaseNotesLastVersion

Why it was refuted

The defaults write targets the UTM app inside a disposable simulator device the declared test workflow creates and then deletes, is openly labeled '# skip What's New', and touches no host or persistent configuration; the D3 'contradiction' misreads a release-notes scoping rule as a write prohibition.

Code execution

criticalRefutedlow confidence

The per-agent command shims instruct the agent to read and execute every step of dot-prefixed skill files under .agents/skills/, so the operative workflow (git history rewrite, force-push, gh release/PR creation) lives in hidden paths outside the visible command entry points, although the referenced files are shipped in this artifact and their shown content is the declared UTM workflow.

.claude/commands/utm-submit.md:8

`.agents/skills/utm-submit/SKILL.md`, executing its steps end to end.

Why it was refuted

The dot-path indirection is declared in both directions — each shim names the exact canonical file it defers to and the skill says the per-agent entries 'just point here' — and the pointed-to file ships in this artifact with shown content matching the declared description, including the squash and force-push workflow.

Code execution

criticalRefutedlow confidence

Documentation instructs agents to perform releases by loading another skill's instructions from the dot-directory file .agents/skills/utm-release/SKILL.md, content not shown in this batch and outside the utm-submit skill's declared PR-submission purpose, so the agent would follow unverified instructions; residue R41-R43 (docs.getutm.app, getutm.app URLs in SRC:a5f9ab17f3d9e5b3) were adjudicated necessary because they are static installation links inside a release-notes template marked to be used verbatim.

Documentation/Release.md:18

Agents can do all of this with the `/utm-release` skill

Why it was refuted

The requested file was served: .agents/skills/utm-release/SKILL.md stays entirely within the declared release workflow — notes are written to scratch and the agent must stop for user approval before any push or release, secrets are explicitly off-limits, all network calls are gh against utmapp/UTM, and force-push is forbidden — so the finding's premise of unverified, potentially harmful instructions no longer holds. The reference is also openly declared in Release.md's own text (a plain labeled Markdown link describing the skill's behavior), not concealed, so the 'hidden file' framing fails.

Agent hijacking

highRefutedlow confidence

utm-review instructs the agent to read CONTRIBUTING.md and AGENTS.md as the authoritative audit checklist and describes AGENTS.md as overriding default tool behavior, while neither file is part of the reviewed artifact content, so the agent follows unreviewable runtime instructions.

.agents/skills/utm-review/SKILL.md:26-32

(`AGENTS.md` overrides default tool behavior for this repo

Why it was refuted

Reading CONTRIBUTING.md/AGENTS.md as the audit checklist is the review workflow's openly declared core capability (D10), stated with rationale in the skill body, and the AGENTS.md override is itself declared and scoped in the same sentence, so no concealed or undeclared hijack remains.

Privilege escalation

highRefutedlow confidence

package.sh forges Apple-private entitlements (com.apple.private.hypervisor, com.apple.private.security.no-sandbox, platform-application) and applies them to the packaged app binary via ldid fake-signing for the deb and ipa distribution modes.

scripts/package.sh:307

<key>com.apple.private.security.no-sandbox</key>

Why it was refuted

The no-sandbox and platform-application keys sit only inside the ipa-hv branch: the ipa-mode plist (SRC:2fb41726f650d38e) and the deb-mode plist (SRC:c9d4d94f5aedeea1) both end at com.apple.private.memorystatus with no such keys, so the claim that this set is applied 'for the deb and ipa distribution modes' is contradicted; the ipa-hv entitlement set is correctly captured by F6.

Privilege escalation

mediumRefutedlow confidence

The repository's unsigned-build entitlements file disables library validation and grants an unrestricted outbound-network sandbox exception, a permission-bypass surface broader than the declared PR-submission purpose of the skill, though it plausibly supports the virtualization app's legitimate networking and plugin needs (undeclared by the skill's description).

Platform/macOS/macOS-unsigned.entitlements:25

(allow network-outbound)

Why it was refuted

Refuted: entitlements are static permission grants for the unsigned virtualization build, so the alleged harm is broad-permissions-alone, an accepted carve-out, and the finding itself concedes the plausible legitimate networking and plugin needs; no instruction or concrete sink is present.

Coverage gaps 80

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-Linux.imageset/linux.pdf

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-Windows.imageset/windows.pdf

context:unanalyzable_binary pdf content is only byte-scanned

Platform/Assets.xcassets/Logo-macOS.imageset/macos.pdf

context:unanalyzable_binary binary content is only byte-scanned

scripts/resources/UTM-drive.icns

frontmatter_unparseable while parsing a block mapping

.claude/commands/utm-release.md