ios-sync
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell command execution to detect the environment, read configurations, and run build processes such as
swift runandxcodebuild. This includes dynamic execution viaevaland process substitution of local vendor-provided binaries. - [DATA_EXFILTRATION]: The skill manages telemetry and artifact synchronization, which involves sending project-related data to external services. These operations are subject to user consent and opt-in configuration as defined in the skill logic.
- [PROMPT_INJECTION]: The skill reads external project files (Swift source and
CLAUDE.md) to inform its regeneration logic, presenting a surface for indirect prompt injection. - Ingestion points: Local Swift source files and project
CLAUDE.mdmetadata. - Boundary markers: Employs
// GSTACK-EDIT-LINEto distinguish generated content from user edits in Swift templates. - Capability inventory: Includes file read/write access, shell command execution, and network operations.
- Sanitization: The skill does not explicitly sanitize the content of ingested source files before processing.
- [SAFE]: All identified behaviors, including the use of local binaries and remote data syncing, are consistent with the documented purpose of the
gstacktoolset and originate from the recognized author's infrastructure.
Audit Metadata