The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted project configuration files and source code, which creates a vulnerability surface for indirect prompt injection.
Ingestion points: The skill reads project manifest files such as Package.swift, Project.swift, and project.yml, as well as the project's .swift source files during the detection and verification phases.
Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the contents of these project files as untrusted data or to ignore instructions embedded within them.
Capability inventory: The skill has access to the Bash tool to execute complex build and project generation commands like swift build, swift test, tuist generate, and xcodegen generate. In SwiftPM and Tuist, the manifest files themselves are executable Swift code that runs during these processes.
Sanitization: The instructions do not specify any sanitization, validation, or isolated execution for the project manifests before the agent executes the build tools.
[COMMAND_EXECUTION]: The skill instructions direct the agent to interpolate user-supplied arguments directly into shell commands, creating a potential command injection surface.
Evidence: The $ARGUMENTS variable is used to collect user input like path and --destination. These are then used in shell commands, such as xcodebuild -scheme <scheme> -destination "<dest>" test. If the agent platform does not strictly escape these inputs, an attacker providing values for these arguments could inject arbitrary shell commands (e.g., appending ; command to the destination string).
[DATA_EXFILTRATION]: While no explicit exfiltration is present, the combination of the Read and Bash tools allows for the possibility of data being read and sent externally if the agent is manipulated via indirect injection in a project file.

swift-verify