apple-vision-image-pipeline
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill contains instructional content focused on security best practices for image processing. It emphasizes memory bounding, arithmetic overflow prevention, and input validation.
- [SAFE]: All external links point to official Apple developer documentation, which are trusted resources.
- [SAFE]: The skill provides explicit guidance on privacy preservation, including instructions to strip sensitive metadata (GPS, EXIF) and avoid logging user content.
- [INDIRECT_PROMPT_INJECTION]: While the skill defines procedures for handling untrusted data (images and OCR results), it does so to provide security guidance rather than posing a risk.
- Ingestion points: Image files and clipboard data are identified as untrusted sources in SKILL.md and pipeline-contracts.md.
- Boundary markers: The skill mandates treating all input as untrusted and requires deterministic validation policies.
- Capability inventory: The documentation covers image decoding (ImageIO), text recognition (Vision), and file writing (Core Graphics).
- Sanitization: The skill requires arithmetic overflow checks, metadata allowlisting, and post-encoding validation to ensure output integrity.
Audit Metadata