releasing-macos-apps
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard macOS system utilities and developer tools including
xcodebuildfor building,codesignfor security verification,hdiutilfor creating disk images, andsecurityfor keychain management. - [EXTERNAL_DOWNLOADS]: The workflow interacts with well-known services such as GitHub for release management and asset hosting, and Apple's notarization servers for security scanning. These are standard services for macOS software distribution.
- [CREDENTIALS_SAFE]: Instructions for handling sensitive information (Apple ID passwords, Sparkle private keys) follow best practices by recommending the use of the macOS Keychain or environment variables rather than hardcoding credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes project configuration files such as
.xcconfigandappcast.xml. While these are external data sources, their use is inherent to the primary purpose of managing software releases, and no unsafe interpolation patterns were detected.
Audit Metadata