xcode-project-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and analyze external project data.
- Ingestion points: Local Xcode project files (".xcodeproj", "Podfile") and build timing summaries from "xcodebuild" logs.
- Boundary markers: The skill includes explicit instructions requiring developer approval before any project files, schemes, or build settings are modified.
- Capability inventory: Reading local configuration and proposing changes to project settings.
- Sanitization: The skill relies on the underlying model's logic to process the data, with the manual approval step acting as a critical safety boundary.
- [COMMAND_EXECUTION]: The skill instructions suggest using "xcodebuild -showBuildTimingSummary" to gather performance data. This is a standard developer command executed within the intended scope of project analysis.
- [EXTERNAL_DOWNLOADS]: The skill references multiple external technical resources for build optimization guidelines. These references point to official Apple documentation, well-known industry platforms like Bitrise, and the author's own professional domains (SwiftLee, RocketSim). These references are documented as part of the skill's knowledge base and are considered safe sources of information.
Audit Metadata