The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses various macOS system utilities (codesign, spctl, otool, strings, plutil) to analyze the security posture of applications. These are standard tools for verification and auditing.
[EXTERNAL_DOWNLOADS]: The skill utilizes npx asar to extract Electron application resources. asar is an industry-standard tool for managing Electron archives and is executed via the standard Node.js package runner.
[INDIRECT_PROMPT_INJECTION]: The skill ingests and processes data from external applications, including source code, metadata, and binary strings. While this data could theoretically contain instructions designed to mislead the agent, this is a known risk when performing automated security audits on untrusted files.
Ingestion points: The skill reads file contents from the target application path provided by the user (scripts/audit-mac-app.sh).
Boundary markers: None present.
Capability inventory: The skill can write audit reports to the local file system and execute shell-based analysis commands.
Sanitization: No specific sanitization of the audited data is performed before it is presented to the agent.

audit-mac-app