apple-crash-symbolication
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Mach-O DWARF symbol files from the Microsoft public symbol server (msdl.microsoft.com) based on binary UUIDs extracted from the crash log. This is a standard procedure for symbolicating .NET runtime binaries.
- [COMMAND_EXECUTION]: Orchestrates the execution of local diagnostic tools including atos and dwarfdump to resolve memory addresses to source code locations.
- [INDIRECT_PROMPT_INJECTION]: Processes crash logs in .ips (JSON) format, which represents a potential attack surface for embedded instructions. 1. Ingestion points: Crash logs provided via the CrashFile parameter in the Symbolicate-Crash.ps1 script. 2. Boundary markers: The script validates the input format (must be JSON) and includes specific logic to identify and stop if no relevant .NET runtime frames are present. 3. Capability inventory: The skill has the ability to run PowerShell scripts, perform network downloads, and execute local binaries. 4. Sanitization: Library names are sanitized using GetFileName to prevent path traversal when creating local dSYM bundles, and the script handles duplicate keys in JSON parsing to ensure stability.
Audit Metadata