capacitor-release
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFE
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill promotes secure handling of sensitive data. It explicitly warns against checking keystores, .p8 API keys, or passwords into version control, directing the agent to use CI/CD secrets and environment variables instead.
- [COMMAND_EXECUTION]: Provides instructions for standard mobile build and signing commands using xcodebuild, Gradle, and the Capacitor CLI. These are required for the skill's primary function.
- [EXTERNAL_DOWNLOADS]: References the '@capawesome/capacitor-live-update' package for managing over-the-air updates.
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface by instructing the agent to fetch and follow configuration steps from external plugin README files.
- Ingestion points: External plugin documentation accessed during the plugin setup phase.
- Boundary markers: None specified for the external content.
- Capability inventory: The skill has permissions to modify native project configurations and run shell commands.
- Sanitization: No sanitization is mentioned for the fetched content.
Audit Metadata