The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes several command-line utilities including xcodebuild for building applications, xcodegen for project generation, and security for managing code signing identities. These are standard tools for the described development environment.
Evidence: Use of security find-identity -v -p codesigning to retrieve Team IDs and xcodebuild -destination ... build for simulator/device testing.
The skill mentions pkill -9 Xcode as a troubleshooting step to clear DerivedData. While this is a process termination command, it is used here as a benign utility to resolve file locking issues common in Xcode development.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it is designed to process external project files (project.yml), build logs, and error messages (e.g., Apple notarization conflicts) to provide debugging assistance.
Ingestion points: The agent reads project.yml configurations and build error outputs from the local environment.
Capability inventory: The skill has the capability to execute shell commands for building and signing code.
Boundary markers: The instructions provide clear structure for the agent, though they do not include specific delimiters for untrusted build output.
Sanitization: Not explicitly present; however, the risk is considered low as the agent is operating within a standard developer workflow on project-specific data.
[SAFE]: Instructions for handling certificates and API keys follow security best practices by recommending the use of GitHub Secrets and environment variables instead of hardcoding sensitive information.
Evidence: Guidance in references/apple-codesign-notarize.md explains how to export certificates to .p12 files and store them as Base64-encoded GitHub Secrets.

developing-ios-apps