The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from local Xcode projects, including source code, build logs, and project structures, which serves as an entry point for untrusted instructions.
Ingestion points: The tools XcodeRead, XcodeGrep, XcodeLS, and GetBuildLog allow the agent to read potentially attacker-controlled content from the filesystem.
Capability inventory: The skill possesses extensive write and execution capabilities, including XcodeWrite, BuildProject, ExecuteSnippet, and RunAllTests.
Boundary markers: There are no specific instructions or delimiters defined to prevent the agent from following instructions embedded within the project files.
Sanitization: No sanitization or validation of the ingested project data is mentioned in the skill instructions.
[COMMAND_EXECUTION]: The skill relies on executing system commands through the xcrun utility to maintain the MCP bridge (xcrun mcpbridge) and to perform build and test operations (BuildProject, RunAllTests).
[DYNAMIC_EXECUTION]: The ExecuteSnippet tool explicitly allows the agent to generate and execute code snippets locally within the context of a project file, which is a powerful dynamic execution capability that could be abused if the agent's intent is compromised.

xcode-mcp