The Agent Skills Directory

[SAFE]: The skill operates as a high-level development assistant and architectural guide. It does not include any obfuscated code, remote execution triggers, or persistence mechanisms.
[DATA_EXPOSURE_&_EXFILTRATION]: No evidence of hardcoded credentials or attempts to access sensitive system files (e.g., .ssh, .aws) was found. The skill specifically includes educational content in coding-best-practices/architecture-patterns.md that instructs developers to avoid hardcoding secrets and to use secure storage like Keychain.
[EXTERNAL_DOWNLOADS]: The skill uses the WebFetch tool to access documentation. In ui-review/SKILL.md, it references official Apple Human Interface Guidelines (developer.apple.com). These references are to well-known, trusted official services and are handled neutrally as part of the skill's primary function.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface in modules like coding-best-practices and ui-review where it ingests untrusted user code for review. However, the risk is mitigated by the skill's use of structured review templates and specific checklists which guide the agent to perform technical analysis rather than execute logic from the provided code.
[COMMAND_EXECUTION]: The skill does not contain any shell command execution or dynamic context injection patterns. The Write tool in the app-planner module is used legitimately to create project documentation files as requested by the user.

ios-development