The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md specify the use of npx --yes serve-sim@latest, which fetches and executes a package from the npm registry at runtime. Running unversioned packages from remote registries introduces a supply chain risk.
[REMOTE_CODE_EXECUTION]: The use of npx to run an external utility constitutes remote code execution, as the package content is retrieved from a remote server and executed on the local machine.
[COMMAND_EXECUTION]: The scripts/swiftui-preview-browser.mjs script makes extensive use of system commands to interact with the iOS Simulator and build tools:
It uses xcrun simctl for simulator lifecycle management, including boot, install, launch, terminate, and get_app_container.
It uses xcodebuild to compile both the generated host application and the hot-reload dynamic library.
It uses swift package commands (dump-package, describe) to extract metadata from the user's project.
It uses notifyutil to trigger hot-reload events within the simulator process.
[DYNAMIC_EXECUTION]: The skill performs complex runtime code generation and compilation:
It generates Swift source code for a host application and a reload plugin dylib based on the target package's metadata.
It dynamically constructs an Xcode project file (project.pbxproj) to coordinate the build.
It compiles these generated artifacts at runtime using xcodebuild and injects the resulting binaries into the simulator process.
It relies on a local module ./lib/xcode-project.mjs (not included in the analyzed files) to handle project generation logic.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided Swift packages, which creates an attack surface for malicious code to influence the build or execution environment.
Ingestion points: The script reads and parses Package.swift and scans the package directory for source files.
Boundary markers: No boundary markers or "ignore instructions" warnings are utilized when processing content from the Swift package.
Capability inventory: The script has broad capabilities including file system access, network-adjacent operations (via npx), and full command execution for building and running code.
Sanitization: Metadata extracted from the package, such as target names, is interpolated into code templates and command-line arguments without explicit sanitization.

ios-simulator-browser