skills/garrytan/gstack/ios-sync/Gen Agent Trust Hub

ios-sync

Pass

Audited by Gen Agent Trust Hub on Jul 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs shell command execution to detect the environment, read configurations, and run build processes such as swift run and xcodebuild. This includes dynamic execution via eval and process substitution of local vendor-provided binaries.
  • [DATA_EXFILTRATION]: The skill manages telemetry and artifact synchronization, which involves sending project-related data to external services. These operations are subject to user consent and opt-in configuration as defined in the skill logic.
  • [PROMPT_INJECTION]: The skill reads external project files (Swift source and CLAUDE.md) to inform its regeneration logic, presenting a surface for indirect prompt injection.
  • Ingestion points: Local Swift source files and project CLAUDE.md metadata.
  • Boundary markers: Employs // GSTACK-EDIT-LINE to distinguish generated content from user edits in Swift templates.
  • Capability inventory: Includes file read/write access, shell command execution, and network operations.
  • Sanitization: The skill does not explicitly sanitize the content of ingested source files before processing.
  • [SAFE]: All identified behaviors, including the use of local binaries and remote data syncing, are consistent with the documented purpose of the gstack toolset and originate from the recognized author's infrastructure.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 18, 2026, 11:46 AM
Security Audit — agent-trust-hub — ios-sync