capacitor-ios
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses routine developer commands for building and syncing the project, such as
npm run build,npx cap sync ios, andnpx cap run ios. These are standard operations for the Capacitor ecosystem. - [EXTERNAL_DOWNLOADS]: The skill references the installation of official Capacitor packages including
@capacitor/core,@capacitor/cli, and@capacitor/ios. These are well-known libraries from an established technology provider and are used for their intended purpose of mobile app development. - [INDIRECT_PROMPT_INJECTION]: The skill implements a pattern for loading 3D animation metadata from a local JSON file.
- Ingestion points: Animation configurations are fetched from
/assets/assets_index.jsonas described inreferences/threejs-animation-index-pattern.md. - Boundary markers: The data is treated as a technical configuration file for mapping 3D assets.
- Capability inventory: The processed data is used exclusively for configuring Three.js
AnimationMixerand UI labels. There are no associated capabilities for file system writing, subprocess execution, or network exfiltration based on the content of the JSON. - Sanitization: The skill provides explicit guidelines for "Required Assertions" to validate the integrity and structure of the JSON data before it is used at runtime.
Audit Metadata