apple-privacy-telemetry
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides defensive programming guidelines and privacy invariants to prevent data exposure. No malicious code, persistence mechanisms, or unauthorized network operations were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill documents the handling of external telemetry data, establishing a managed attack surface. Evidence Chain: 1. Ingestion points: Application events and MetricKit diagnostic reports (SKILL.md, telemetry-contract.md). 2. Boundary markers: Implementation of a TelemetryPolicy and ApprovedEnvelope in isolated modules (telemetry-contract.md). 3. Capability inventory: Sink operations are limited to OSLog and OTLP with no dynamic code execution or subprocess spawning. 4. Sanitization: Enforcement of closed typed allowlists, bucketing of high-cardinality values, and removal of branch/developer metadata (telemetry-contract.md, verification.md).
Audit Metadata