The Agent Skills Directory

[METADATA_POISONING]: The skill's frontmatter and documentation claim support for 'iOS 27' and 'Xcode 27'. As these versions do not exist, this is deceptive metadata that could lead to a misjudgment of the skill's actual capabilities or the validity of the research it performs.
[EXTERNAL_DOWNLOADS]: In references/ui-automation.md, the skill instructs users to install a third-party tool via brew tap cameroncooke/axe. This downloads software from a personal GitHub repository that is not part of a recognized trusted organization or well-known service.
[DYNAMIC_EXECUTION]: The debug_lldb_command tool in references/debugging.md allows the execution of arbitrary LLDB commands. This provides a high-privilege execution sink that could be abused to run arbitrary code in the context of the application being debugged.
[COMMAND_EXECUTION]: The skill relies on several MCP tools (e.g., build_sim, test_sim, tap) that execute shell-level commands and automation scripts on the host system to interact with simulators and physical devices.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection by processing external data sources.
Ingestion points: The skill reads Xcode project structures through discover_projs and extracts UI view hierarchies, including accessibility labels, using snapshot_ui in references/ui-automation.md.
Boundary markers: There are no instructions for the agent to treat data from project files or UI labels as untrusted or to ignore embedded instructions within those sources.
Capability inventory: The skill has extensive system-level capabilities, including building and running code, as well as executing arbitrary debugger commands via debug_lldb_command.
Sanitization: The skill lacks explicit sanitization or validation of the content retrieved from the local filesystem or UI snapshots before it is processed by the agent.

ios