The Agent Skills Directory

[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and analyzes untrusted data from the app under test during its QA loop.
Ingestion points: The agent fetches screenshots (/screenshot), accessibility element trees (/elements), and app state snapshots (/state/snapshot), and reads the project's Swift source code to generate accessors.
Boundary markers: There are no documented boundary markers or specific instructions for the model to ignore embedded commands within the data retrieved from the device (such as malicious strings in accessibility labels).
Capability inventory: The skill operates with high-privilege tools, including Bash, Read, Write, and Edit, which could be abused if the agent is deceived by injected instructions.
Sanitization: There is no evidence of sanitization or validation of UI element content before it is processed by the agent.
[COMMAND_EXECUTION]: The skill's preamble and workflow execute numerous local binaries and scripts located in ~/.claude/skills/gstack/bin/ to manage configuration (gstack-config), telemetry (gstack-telemetry-log), and session state (gstack-slug, gstack-session-kind). It also utilizes xcodebuild and devicectl to build, install, and launch the application on the iOS device.
[DATA_EXFILTRATION]: The skill includes an 'Artifacts Sync' feature that, if enabled by the user, publishes project artifacts like plans and designs to a private GitHub repository. While this is presented as a legitimate feature for cross-machine synchronization, it involves the automated transmission of project data to a remote service.
[EXTERNAL_DOWNLOADS]: The DebugBridge dependency added to the project's Package.swift template fetches the swift-syntax package from the official swiftlang repository on GitHub.

ios-qa