serve-sim-placeholder-assets
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/audit-placeholder-assets.mjsexecutes the system utilitiesplutilandsipsusingexecFileSync. - Evidence: The script calls
plutilto convert device profile plists to JSON andsipsto crop and format PNG assets. - These calls are implemented with structured argument arrays, mitigating risks of shell injection.
- [SAFE]: The skill operates entirely on local system paths (
/Library/Developer/CoreSimulator/and/System/Library/CoreServices/CoreTypes.bundle/) to audit device metadata. - No network operations, data exfiltration, or obfuscation techniques were detected.
Audit Metadata