xcode-preview-capture
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (
preview,capture-simulator.sh) to build SwiftUI views and capture simulator screenshots. These operations are performed using the plugin's internal script directory. - [INDIRECT_PROMPT_INJECTION]: The skill processes external Swift source files and Xcode projects provided by the user or found in the environment. This presents a surface for indirect injection if a project contains malicious build configurations, though the scope is limited to the development environment.
- Ingestion points: User-specified Swift files, Xcode projects, and workspaces (SKILL.md).
- Boundary markers: None present in the instructions.
- Capability inventory: Shell script execution for building code and capturing simulator output (SKILL.md).
- Sanitization: Not explicitly defined in the skill documentation.
- [DYNAMIC_EXECUTION]: The skill enables the runtime compilation and execution of SwiftUI code within the simulator to generate visual output. This behavior is the primary and documented purpose of the skill.
Audit Metadata