xcode-build-orchestrator

Pass

Audited by Gen Agent Trust Hub on Jun 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes xcodebuild via specialized Python scripts (benchmark_builds.py, diagnose_compilation.py). These scripts use the subprocess.run function with argument lists rather than shell strings, which is the recommended secure practice to prevent command injection.
  • [EXTERNAL_DOWNLOADS]: The skill includes a reference to a GitHub URL in references/orchestration-report-template.md for contributing benchmark results. This targets a well-known service (GitHub) and is used for manual developer contribution rather than automated code execution.
  • [DATA_EXFILTRATION]: No sensitive file access or network exfiltration patterns were identified. The tool operates exclusively on local Xcode project configuration files and build artifacts to generate optimization reports.
  • [PROMPT_INJECTION]: The orchestration logic in SKILL.md defines a structured two-phase workflow that guides the agent through analysis and execution without attempting to override safety guidelines or system constraints.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 20, 2026, 08:10 PM
Security Audit — agent-trust-hub — xcode-build-orchestrator