macos-spm-app-packaging
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides scripts that execute standard macOS developer tools, including
swift,codesign,xcrun,lipo,iconutil, andsips. These are used for their intended purposes: compiling code, signing binaries, submitting to Apple's notarization service, and processing app icons. - [DATA_EXFILTRATION]: The notarization template (
sign-and-notarize.sh) handles sensitive Apple API keys by reading them from environment variables and writing them to a temporary file in/tmpas required byxcrun notarytool. The script correctly implements an exit trap to ensure these temporary files are deleted immediately after use, minimizing local exposure risk. - [COMMAND_EXECUTION]: The dev-loop scripts (
compile_and_run.shandlaunch.sh) usepkillto stop existing instances of the app before relaunching, which is a standard procedure for local development workflows.
Audit Metadata