swift-security-expert
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation files 'references/common-anti-patterns.md' and 'references/compliance-owasp-mapping.md' contain hardcoded Stripe API keys (e.g., 'sk_live_51H7bK2E...' and 'sk_live_4eC39HqLyjWDarjtT1zdp7dc'). These are explicitly labeled as insecure anti-patterns to demonstrate improper credential usage and are not intended for functional use.\n- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to review and audit user-provided source code. This involves processing untrusted data which is a potential surface for indirect prompt injection, although the skill's capabilities are limited to providing textual analysis and it lacks automated execution tools that could be abused.\n- [SAFE]: The skill provides best-practice guidance based on official Apple documentation and industry standards like OWASP MASVS. It appropriately recommends the use of Keychain over insecure storage like UserDefaults and details secure cryptographic patterns using CryptoKit.
Audit Metadata