The Agent Skills Directory

[SAFE]: The skill implements defensive security patterns, such as a dedicated 'security' job in the GitHub Actions workflow that uses grep to proactively scan for hardcoded secrets (e.g., api_key, password, secret) in the codebase.
[SAFE]: Remote dependencies and tool installations, such as brew install swiftlint swiftformat and the use of official GitHub Actions (actions/checkout, actions/cache, actions/upload-artifact), target well-known and trusted service providers.
[SAFE]: Privileged operations, specifically the use of sudo xcode-select to configure the build environment and chmod +x to enable local git hooks, are standard requirements for iOS development and CI/CD pipelines.
[INDIRECT_PROMPT_INJECTION]: The skill involves processing external data from tool outputs (such as xccov JSON coverage reports and swiftlint results) within the CI environment. The use of structured parsing tools like jq and bc for these outputs provides validation and mitigates the risk of command injection or malicious payload execution from untrusted project data.

code-quality-gates