spm-build-analysis

Pass

Audited by Gen Agent Trust Hub on Sep 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a local script scripts/check_spm_pins.py to check for available tags on remote Swift packages. This operation is limited to querying metadata from the project's defined dependencies.
  • [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project data including Package.swift, Package.resolved, and project.pbxproj to provide build recommendations.
  • Ingestion points: Xcode project files (.xcodeproj), Swift Package Manager manifests (Package.swift), and build logs.
  • Boundary markers: No explicit markers are defined for the analyzed content.
  • Capability inventory: Access to local project files and execution of a localized Python helper script.
  • Sanitization: The skill performs diagnostic analysis on the provided data without executing content derived from it.
  • [EXTERNAL_DOWNLOADS]: The skill performs metadata lookups via git ls-remote to verify the existence of tagged versions for package dependencies. These requests target the official repositories specified in the developer's project.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 7, 2026, 09:40 AM
Security Audit — agent-trust-hub — spm-build-analysis