swift-ci-scaffold

Pass

Audited by Gen Agent Trust Hub on Aug 15, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill generates a ci_post_clone.sh script for use in Xcode Cloud. While the script uses brew install and chmod +x, these are standard practices for setting up CI environments and are executed within the context of the user's project/CI runner.
  • [SAFE]: The skill proposes an opt-in Git pre-push hook. It correctly instructs the user to manually enable the hook via git config core.hooksPath, avoiding unauthorized modification of the user's global or local Git configuration.
  • [SAFE]: The skill uses grep and sed for local file analysis and modification (e.g., updating CURRENT_PROJECT_VERSION in project.yml). These operations are scoped to the project directory and are guarded by user confirmation.
  • [SAFE]: The skill explicitly states it cannot automate App Store Connect workflows and provides a manual checklist for the user, demonstrating a clear boundary between local scaffolding and remote service configuration.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 15, 2026, 11:28 PM
Security Audit — agent-trust-hub — swift-ci-scaffold