macos-menubar-tuist-app
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform local build and process management tasks using
tuistand shell scripts (run-menubar.sh,stop-menubar.sh). It also suggests usingcurlto probe backend endpoints. These operations are standard for a developer-oriented skill focused on macOS app lifecycle management. - [INDIRECT_PROMPT_INJECTION]: The skill has a vulnerability surface where it ingests external data from backend endpoints via
curlto verify API structure. - Ingestion points: Workflow step 2 mentions using
curlto verify endpoint shapes and response mapping. - Boundary markers: None identified for external data processing.
- Capability inventory: The skill has the ability to execute shell commands (
bash), build tools (tuist), and network commands (curl). - Sanitization: No specific sanitization or validation of the ingested API data is described beyond architectural decoding logic.
Audit Metadata