xcode-project-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted project data including Xcode project files, build logs, and dependency configurations.
- Ingestion points: Processes
.xcodeproj,.xcworkspace,Podfile, and build timing summaries. - Boundary markers: The skill includes explicit "Core Rules" that mandate approval gates before changing project files, schemes, or build settings.
- Capability inventory: Capabilities are limited to reading project metadata and recommending configuration changes; no automated execution of external data is permitted.
- Sanitization: The skill focuses on extracting structured build settings and performance metrics rather than executing arbitrary content from logs.
- [EXTERNAL_DOWNLOADS]: The skill references external technical resources for build optimization best practices.
- Findings: The skill cites official documentation from Apple, Bitrise, and established community experts (e.g., SwiftLee). These are well-known, trusted services and do not involve remote code execution or suspicious payloads.
- [COMMAND_EXECUTION]: The skill analyzes Xcode run script phases but does not execute them directly.
- Findings: Analysis is restricted to auditing script inputs, outputs, and dependency analysis settings to identify parallelism opportunities.
Audit Metadata