The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill recommends installing the axe utility via a third-party Homebrew tap (cameroncooke/axe/axe). This repository is not from a trusted organization or well-known service, presenting a potential supply chain risk.
[COMMAND_EXECUTION]: Extensive shell command usage is present for simulator control and data processing. This includes aggressive process management such as killall -9 Simulator DeviceHub and using kill -INT on background process IDs.
[PRIVILEGE_ESCALATION]: The skill provides commands to modify the security environment of the simulator by adding root certificates to the keychain (xcrun simctl keychain booted add-root-cert). While legitimate for certain testing scenarios, this capability allows for the interception of encrypted network traffic.
[DATA_EXFILTRATION]: The skill accesses sensitive information by reading system crash logs (~/Library/Logs/DiagnosticReports/*.ips) and inspecting application sandbox data via xcrun simctl get_app_container. It also utilizes simctl diagnose, which is noted to potentially collect private user data.
[INDIRECT_PROMPT_INJECTION]: The agent's behavior is influenced by processing external, potentially untrusted data sources such as application UI trees (axe describe-ui), system logs, and project configuration files.
Ingestion points: Data is ingested from xcrun simctl list outputs, accessibility trees via axe, crash report files, and .axiom/preferences.yaml.
Boundary markers: There are no clear delimiters or instructions to ignore embedded commands within the data being processed.
Capability inventory: The skill possesses broad capabilities including file system writes, process termination, and simulator-level administrative controls.
Sanitization: There is no evidence of sanitization or input validation for data retrieved from simulators or diagnostic logs before it is processed by the agent.

axiom-test-simulator