The Agent Skills Directory

[DYNAMIC_EXECUTION]: Phase 2 uses eval to process build settings extracted via xcodebuild and awk. If a repository contains malicious project files (such as .xcodeproj or project.yml) with shell metacharacters in settings like PRODUCT_BUNDLE_IDENTIFIER, this could lead to arbitrary command execution when the settings are evaluated.
[COMMAND_EXECUTION]: Phase 5 uses pkill and osascript to terminate processes based on variables derived from project settings. This creates a surface for targeting unintended processes if those variables are manipulated via the repository's configuration files.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from git logs and diffs to generate instructions for the user verification step. \n- Ingestion points: Commit messages and diff statistics extracted from the local git repository. \n- Boundary markers: Absent; the data is summarized directly into the agent's response to the user. \n- Capability inventory: Includes eval, xcodebuild, pkill, osascript, and git push. \n- Sanitization: No sanitization is performed on commit history content; minimal parsing is applied to project settings.
[DYNAMIC_EXECUTION]: The skill generates and executes a Python one-liner (python3 -c) to parse JSON output from the simctl utility, which constitutes runtime execution of code generated from command output.

verify-and-land