build-distribution

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [SAFE]: The skill provides documentation and workflows for Apple platform distribution. It encourages security best practices such as using automatic signing, managing CI secrets securely, and utilizing privacy manifests.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow that ingests codebase data and build settings via specialized agents and tools. While this is a standard requirement for its primary purpose, it constitutes a data ingestion surface. 1. Ingestion points: Project codebase exploration and build settings retrieval as specified in the Agent Workflow (SKILL.md). 2. Boundary markers: None explicitly defined for tool outputs or codebase reading. 3. Capability inventory: Uses specialized tools and agents to read project configuration and validate builds (SKILL.md). 4. Sanitization: No specific sanitization of ingested project metadata is described; however, the operations are limited to read-only diagnostics and standard build tools.
  • [COMMAND_EXECUTION]: The skill provides standard command-line instructions for managing Apple certificates and uploading builds to TestFlight. 1. Evidence: Troubleshooting and upload sections include commands such as security find-identity, codesign, xcrun altool, and xcrun notarytool (references/code-signing.md, references/testflight.md). 2. These are routine operations for the task and do not involve unauthorized privilege escalation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 12:23 PM