xcodebuildmcp-packaging-resource-review
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is a set of instructional guidelines for the agent to review build and packaging integrity. It does not contain any malicious patterns such as exfiltration, persistence, or obfuscation.
- [COMMAND_EXECUTION]: The skill references standard development validation commands such as
npm run buildandnpx skill-check. These are intended for local environment verification within a trusted development workflow. - [INDIRECT_PROMPT_INJECTION]: The skill involves reading and reviewing local files like
package.json, scripts, and manifests. While this allows the agent to ingest external data, the primary purpose is for code review within a developer's environment, and it lacks the high-risk capabilities required for an injection to escalate into a significant security threat. - [EXTERNAL_DOWNLOADS]: The skill notes that network-dependent packaging behavior should be avoided without verification or checksums, which follows security best practices for supply chain integrity.
Audit Metadata