apple-dev-best-practices
Warn
Audited by Gen Agent Trust Hub on Apr 6, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
xcodebuildmcppackage from the npm registry usingnpx -y xcodebuildmcp@latestinreferences/xcode-claude-integration.md, which downloads unversioned code from an external repository. - [REMOTE_CODE_EXECUTION]: The recommended installation method using
npxinreferences/xcode-claude-integration.mdinvolves downloading and executing remote scripts at runtime. - [COMMAND_EXECUTION]: The integration guide in
references/xcode-claude-integration.mdprovides configuration forPostToolUseandPreToolUsehooks in.claude/settings.jsonthat automatically execute shell commands (bash,python3,swiftlint) triggered by the agent's file modification activities. - [PROMPT_INJECTION]: The skill exhibits keyword stuffing in the
descriptionfield ofSKILL.md, listing numerous Apple frameworks and tools to broaden the skill's trigger surface (Metadata Poisoning). - [PROMPT_INJECTION]: The skill processes project files like code and markdown without explicit sanitization or boundary markers, creating a surface for indirect prompt injection.
- Ingestion points: Processes
.swift,.md, and project configuration files from the local environment. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are defined for processed content.
- Capability inventory: Access to file modification and potentially shell command execution tools.
- Sanitization: Lacks filtering or validation of content read from external project files.
Audit Metadata