ai-seo (RocketSimApp app-marketing skills) — agentic threat model

Not certain from the listing — likely relies on external commercial APIs (e.g., OpenAI) or local Xcode-integrated models. Primary threats include prompt injection leading to biased or manipulated SEO recommendations, and mis-aligned outputs that could degrade app store ranking.

Not certain from the listing — the agent processes local app metadata, descriptions, and marketing copy. Risks include data leakage of unreleased app features or marketing strategies if telemetry or external LLM logging is active.

The agent is structured as a specific 'skill' within the RocketSimApp framework. Threat vector involves insecure tool integration where the SEO skill might be manipulated to read or overwrite arbitrary local files beyond the designated marketing assets.

Ships alongside the RocketSim desktop product, meaning it runs locally on the developer's macOS workstation. Main threat is local privilege escalation or unauthorized file system access if the host application lacks proper sandboxing.

Not certain from the listing — there is no mention of built-in guardrails, drift detection, or output verification for the generated SEO keywords and copy, creating a blind spot for hallucinated or trademark-infringing content.

As an open-source, free developer tool skill, it lacks enterprise security controls, centralized audit logging, or formal compliance certifications. Security relies entirely on the host workstation's configuration.

Part of a broader 'app-marketing skill set' (ab-test-setup, copywriting, etc.). Threat of cascading failures or lateral prompt injection if a compromised skill passes malicious payloads or corrupted context to the ai-seo skill.