The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions to run shell commands such as find, mdfind, and xcrun to locate project assets and interact with the iOS simulator. The scripts/make_icon.py script utilizes subprocess.run to execute the official Apple ictool utility for icon rendering. This use of subprocess is implemented using a list of arguments, which is a recommended practice to avoid shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied SVG files to extract path coordinates and color values via regular expressions. These values are then interpolated into new SVG and JSON files. This creates a potential surface for indirect injection if a malicious SVG contains specially crafted strings designed to break out of attributes or influence downstream processing.
Ingestion points: The scripts/make_icon.py script reads from a local SVG file specified by the --source argument.
Boundary markers: No explicit delimiters or instructions are provided to the agent or the script to ignore potentially malicious embedded content within the source artwork.
Capability inventory: The script has the ability to execute the ictool binary, delete directories using shutil.rmtree, and write new files to the filesystem.
Sanitization: The script extracts data using regex but does not perform escaping or validation on the resulting strings before they are placed into new file templates.

solo-apple-app-icon