audit-xcode-security-settings
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes a local Python script
scripts/filter_build_settings.pyto filter and process build settings data. The script utilizes standard libraries for JSON parsing and regex filtering, performing no network or privileged operations.- [COMMAND_EXECUTION]: Employs the macOSplutilutility to create and modify XML property list files for workspace and entitlement configurations as part of the hardening process.- [INDIRECT_PROMPT_INJECTION]: The skill processes data from potentially untrusted project files such as.xcodeproj,.xcconfig, and.entitlementsduring its analysis phases. - Ingestion points: Reads project configuration and build settings via
XcodeReadandGetTargetBuildSettingstools. - Boundary markers: Uses structured tool outputs and a dedicated filtering script rather than relying on unstructured file reads.
- Capability inventory: Can modify project configurations using
UpdateProjectBuildSetting,UpdateTargetBuildSetting, and file editing tools. - Sanitization: Implements structured JSON parsing and regex-based filtering in its helper script to manage the ingested configuration data.
Audit Metadata