manipulate-xcodeproj

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external command-line utility, xcp (XcodeProjectCLI), using the Homebrew package manager (brew install xcp).
  • [COMMAND_EXECUTION]: The skill functions by executing various subcommands of the xcp tool to read and modify .xcodeproj files and .xcassets directories.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it processes external project files. Ingestion points: The skill reads project metadata and structure from .xcodeproj and .xcassets paths. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. Capability inventory: The skill uses the xcp tool to perform file-write operations and project configuration changes. Sanitization: There is no evidence of validation or sanitization of the project file content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 06:42 PM