cocoapods-to-spm
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [DYNAMIC_CONTEXT_INJECTION]: The skill uses the dynamic context execution syntax to perform project discovery when loaded.
- Evidence: The
SKILL.mdfile contains a shell command!node -e "..."that reads the localpackage.jsonto filter for Capacitor and Cordova related dependencies. - Evidence: The
SKILL.mdfile contains afindcommand!find ios -maxdepth 5 ...to locate specific iOS project files likePodfile,Package.swift, andInfo.plist. - Analysis: These commands are used for introspection of the user's project to provide the AI agent with the necessary context for the migration task. They do not access sensitive system files (e.g., SSH keys, credentials), do not perform network exfiltration, and do not incorporate unvalidated user input into shell execution. This behavior is consistent with the skill's primary purpose and is considered safe tooling.
Audit Metadata