audit-xcode-security-settings
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Bash commands (
grep) to inspect the Xcode project'sproject.pbxprojfile. This is used legitimately to verify that security settings have been applied correctly in scenarios where project-level configuration files (xcconfigs) are not available.- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from the Xcode project (build settings and entitlements) and a user-editable plan file (xcode-security-audit-plan.md). - Ingestion points:
project.pbxproj,.xcconfig,.entitlements, andxcode-security-audit-plan.md. - Boundary markers: The skill instructs the agent to parse the plan file based on specific Markdown patterns (bullets and bold text).
- Capability inventory:
XcodeUpdate,AddEntitlement,UpdateTargetBuildSetting, and Bashgrep. - Sanitization: The skill relies on structured parsing of the plan file and filtered build setting output to mitigate risks from untrusted data input.- [DYNAMIC_EXECUTION]: The skill includes a local Python script (
apple/scripts/filter_build_settings.py) to process build setting data. Technical review confirms the script is static, uses only standard libraries, and performs straightforward filtering of JSON data based on a predefined list of security settings.
Audit Metadata