The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes a Python script (scripts/check.py) that executes local Xcode command-line tools (xcrun xcprojformatter and xcodebuild -list). These calls are implemented using subprocess.run with a list of arguments, which is a secure practice that prevents shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes project.xcproj files, which serves as an ingestion point for untrusted data. An attacker could potentially embed malicious instructions within project metadata (like target names or build settings) to influence the agent's actions during the editing workflow.
Ingestion points: The project.xcproj file is read during the editing workflow described in SKILL.md and by the scripts/check.py validation script.
Boundary markers: The skill lacks explicit markers or instructions to the agent to ignore natural language instructions found within the JSON data.
Capability inventory: The skill allows the agent to write to the file system and execute shell commands through the check.py script and manual ID generation.
Sanitization: There is no evidence of sanitization or validation of the content within the JSON project files before it is interpreted by the agent.

xcproj