spm-build-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local script
scripts/check_spm_pins.pyto check for available tags on remote Swift packages. This operation is limited to querying metadata from the project's defined dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project data including
Package.swift,Package.resolved, andproject.pbxprojto provide build recommendations. - Ingestion points: Xcode project files (
.xcodeproj), Swift Package Manager manifests (Package.swift), and build logs. - Boundary markers: No explicit markers are defined for the analyzed content.
- Capability inventory: Access to local project files and execution of a localized Python helper script.
- Sanitization: The skill performs diagnostic analysis on the provided data without executing content derived from it.
- [EXTERNAL_DOWNLOADS]: The skill performs metadata lookups via
git ls-remoteto verify the existence of tagged versions for package dependencies. These requests target the official repositories specified in the developer's project.
Audit Metadata