apple-docs

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill fetches documentation and assets from official Apple domains, including developer.apple.com and docs-assets.developer.apple.com. These are well-known and trusted services.
  • [COMMAND_EXECUTION]: Uses standard system tools like curl and jq via a provided shell script (appledoc.sh) to perform documentation lookups. It also provides Python 3 snippets for text processing and HTML stripping of Apple's policy pages. All command execution is focused on the legitimate task of data retrieval and formatting.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from Apple's documentation site. This represents a potential indirect prompt injection surface; however, the risk is mitigated by the trusted nature of the source and the skill's specific field-based parsing approach.
  • Ingestion points: Documentation JSON and HTML from developer.apple.com.
  • Boundary markers: Instructions explicitly tell the agent to cite sources and quote only relevant sentences.
  • Capability inventory: Restricted to curl for reading and jq/python3 for processing.
  • Sanitization: Implements specific field extraction and HTML stripping filters.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 10:25 AM