[SAFE]: The skill provides standard boilerplate configurations and bash utility scripts for bootstrapping and packaging macOS apps using Swift Package Manager.
[COMMAND_EXECUTION]: Local shell scripts execute standard developer toolchain commands such as swift build, codesign, lipo, and openssl. These actions are well-contained, expected for an app packaging workflow, and present no automated or hidden security risks.
[CREDENTIALS_UNSAFE]: The sign-and-notarize.sh template securely processes App Store Connect API credentials by reading them from standard environment variables, writing them to a temporary file for notarytool consumption, and leveraging a shell trap to guarantee deletion immediately upon execution completion.

macos-spm-app-packaging