The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Swift source code from the local project and ingests real-time UI data (accessibility elements and screenshots) from an iOS device, which could contain adversarial instructions targeting the agent.
Ingestion points: The skill reads project Swift files using the Read tool and the gen-accessors script, and fetches device UI state via the gstack-ios-qa-daemon proxy.
Boundary markers: No explicit boundary markers or instructions to disregard embedded data directives are provided when processing ingested code or UI elements.
Capability inventory: The skill possesses extensive capabilities including Bash, Write, and Edit tools, and can execute system commands like xcodebuild and devicectl to modify local files and drive a physical device.
Sanitization: There is no prompt-level sanitization to filter or escape instructions that may be embedded in the analyzed source code or captured UI content.
[DYNAMIC_EXECUTION]: The skill dynamically generates Swift source code (StateAccessor.swift) based on the contents of the user's project and executes it after compilation via xcodebuild. It also uses dlopen and dlsym at runtime within its DebugBridgeTouch component to load and call private iOS system frameworks like IOKit and libAccessibility.dylib for touch synthesis.
[COMMAND_EXECUTION]: The skill utilizes shell commands and system utilities including xcodebuild, devicectl, bun, and python3 to manage the bridge deployment, daemon lifecycle, and device interaction.
[EXTERNAL_DOWNLOADS]: Fetches the swift-syntax package from the official swiftlang GitHub repository as a SwiftPM dependency for the accessor generation tool.

ios-qa