blitz-app-smoke
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a bash script (
run.sh) to coordinate iOS build and test tools likexcodebuild,xcrun, andblitz. These operations are well-scoped to the intended purpose of app testing and use standard shell quoting to prevent command injection. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local configuration files (
codex.blitz.toml) and project file structures. While this represents an attack surface, the processing is performed using local shell tools (awk, sed, find) on the user's local environment, and dangerous actions like running tests are gated by user confirmation or explicit policy configuration. - [EXTERNAL_DOWNLOADS]: The script identifies missing dependencies and directs the user to official sources for installation (such as blitz.dev or the project's official GitHub repository). It does not perform unauthorized background downloads or remote code execution.
Audit Metadata