macos-accessibility-tcc
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a protocol for interacting with external application UI data, creating an ingestion surface that is managed with strict defensive protocols.\n
- Ingestion points: UI elements and attributes accessed via the Accessibility framework as described in SKILL.md and references/accessibility-client-lifecycle.md.\n
- Boundary markers: Explicit instructions to avoid logging UI titles, document contents, and element values.\n
- Capability inventory: Guidance covers cross-process inspection and control via AXUIElement and AXObserver APIs.\n
- Sanitization: Mandates the classification of roles like kAXSecureTextFieldSubrole and prohibits reading values from any element identified as sensitive.\n- [DATA_EXFILTRATION]: The skill establishes robust privacy protections by enforcing a redaction-by-omission policy for secure fields and prohibiting the logging of UI tree dumps or sensitive attributes.
Audit Metadata