app-intents
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEPROMPT_INJECTIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill's core instructions and reference files attempt to override the agent's factual knowledge regarding software release timelines. It mandates that the agent target "the 27 releases" (WWDC 2026, iOS 27) and use these hypothetical versions instead of real ones (e.g., "use that, not 'iOS 19'"). This is a sophisticated context-injection technique aimed at inducing specific hallucinations and enforcing a fictional persona.\n- [METADATA_POISONING]: The skill uses its metadata and instructional body to misrepresent the technical environment it operates within. By presenting a highly detailed and plausible fictional tech stack, it risks leading the agent to generate non-functional code or provide incorrect technical guidance based on non-existent system capabilities.\n- [INDIRECT_PROMPT_INJECTION]: The skill has an inherent attack surface for indirect prompt injection because its primary function is to analyze and review user-provided code. The absence of strict input boundaries or sanitization protocols could allow malicious code snippets to influence the agent's behavior.\n
- Ingestion points: Processes user-supplied Swift code and natural language queries for review and generation across all referenced documents.\n
- Boundary markers: There are no explicit instructions or delimiters defined to separate the skill's instructions from potentially adversarial content in the user's input code.\n
- Capability inventory: The agent is authorized to generate and modify Swift code, providing a potential mechanism for the output of non-functional logic based on malicious input.\n
- Sanitization: The skill does not implement any validation or filtering of the code provided by the user before processing it according to the injected instructions.
Audit Metadata