manipulate-xcodeproj
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of an external command-line utility,
xcp(XcodeProjectCLI), using the Homebrew package manager (brew install xcp). - [COMMAND_EXECUTION]: The skill functions by executing various subcommands of the
xcptool to read and modify.xcodeprojfiles and.xcassetsdirectories. - [INDIRECT_PROMPT_INJECTION]: The skill provides a surface for indirect prompt injection as it processes external project files. Ingestion points: The skill reads project metadata and structure from
.xcodeprojand.xcassetspaths. Boundary markers: No explicit delimiters or instructions to ignore embedded content are provided. Capability inventory: The skill uses thexcptool to perform file-write operations and project configuration changes. Sanitization: There is no evidence of validation or sanitization of the project file content before it is processed by the agent.
Audit Metadata