to-ios-presets
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The build script (
scripts/build-presets.mjs) usesnpm execto download and run theesbuild-wasm@0.25.12package from the public NPM registry. This dependency is pinned to a specific version and used exclusively for bundling generated code. - [COMMAND_EXECUTION]: The build script invokes shell commands using
node:child_process.spawnto execute the bundler. The arguments are strictly controlled by the script logic and target a specific package version. - [DYNAMIC_EXECUTION]: The skill generates JavaScript source files based on application metadata and bundles them into
presets.dist.js. These generated artifacts are intended to be executed on a target device for verification purposes. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external project source code and SDK declarations as context for code generation. This represents an injection surface where untrusted project content could influence the generated output. However, the build script implements security controls, including path canonicalization via
realpathand boundary checks to ensure imports remain within the local presets directory.
Audit Metadata