swift-development

Fail

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: HIGHPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [PRIVILEGE_ESCALATION]: The skill recommends using sudo for system-level configuration changes. Evidence includes sudo xcode-select for switching Xcode versions in references/cicd.md and references/xcodebuild.md, and sudo killall for restarting simulator services in references/troubleshooting.md.
  • [COMMAND_EXECUTION]: Multiple reference files (references/troubleshooting.md, references/code-signing.md) instruct the user or agent to perform recursive deletions on sensitive user paths, specifically rm -rf ~/Library/Developer/Xcode/DerivedData and rm -rf ~/Library/Caches/org.swift.swiftpm. These are destructive operations that could lead to broader data loss if the agent targets the wrong directory.
  • [CREDENTIALS_UNSAFE]: The code signing workflows in references/code-signing.md involve managing certificate files and unlocking keychains using passwords provided via shell variables (e.g., $KEYCHAIN_PASSWORD). These patterns introduce a risk of signing credential exposure if the agent or environment logs are compromised.
  • [DYNAMIC_EXECUTION]: The skill distributes and executes multiple helper bash scripts (scripts/new_package.sh, scripts/run_tests.sh, scripts/format_and_lint.sh, scripts/simulator.sh). These scripts perform complex file system operations, dynamically create configuration files from templates, and invoke various external developer tools.
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions for fetching documentation and specifications from official Apple GitHub repositories and well-known documentation domains. These references target trusted organizations and well-known services and are documented neutrally.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 5, 2026, 05:22 PM
Security Audit — agent-trust-hub — swift-development