ship-from-scratch
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides security-conscious advice, specifically instructing the agent and user to add sensitive mobile signing files (such as .jks, .keystore, .p8, and service-account JSON files) to the project's .gitignore to prevent accidental exposure in version control.
- [SAFE]: The instructions for handling CI/CD secrets recommend using environment variables and base64 encoding for binary artifacts, which is a standard industry practice for secure automation in environments like GitHub Actions.
- [SAFE]: The skill implements a 'Confidence marks' system ([verified], [snippet], [unverified]) to help the agent distinguish between primary vendor information and unconfirmed research, promoting information reliability.
- [SAFE]: Command usage is limited to standard mobile development tools (such as gradlew, xcodebuild, and fastlane) for discovery and build purposes, with no evidence of malicious execution or privilege escalation.
Audit Metadata