axiom-xcode-mcp
Warn
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the
axetool via Homebrew from a third-party GitHub repository (cameroncooke/axe) that is not within the trusted vendor scope. - [PRIVILEGE_ESCALATION]: Documentation includes commands for enabling the Xcode headless server using
sudo(sudo xcrun mcp-server enable), which requires administrative privileges. - [DYNAMIC_EXECUTION]: The skill references and documents the
RunCodeSnippettool, which allows for the runtime compilation and execution of Swift code snippets within the project context. - [COMMAND_EXECUTION]: Extensive documentation of command-line operations using
xcrun,simctl, and theaxeCLI for device and IDE control. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core functionality.
- Ingestion points: Reads project files via
XcodeReadand processes compiler/build logs viaGetBuildLog. - Boundary markers: No explicit instructions or delimiters for isolating external data from instructions are mentioned in the documentation.
- Capability inventory: The skill facilitates file modification (
XcodeWrite), code execution (RunCodeSnippet), and UI automation (axe). - Sanitization: There is no mention of sanitization or validation of the content read from external project files before it is processed by the agent.
Audit Metadata