ping-orchestration-ios-sdk
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill generates and executes several Ruby scripts (
scaffold.rb,add_spm_deps.rb,add_url_scheme.rb) to programmatically configure Xcode project structures and build settings. It also executes shell commands to detect available simulators and verify build status. - [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface by ingesting and analyzing untrusted Journey export JSON files. This data is used to determine which SwiftUI views and SDK modules to generate, creating a pathway where external data influences the agent's logic and output.
- [EXTERNAL_DOWNLOADS]: The skill references and installs external dependencies, including the
xcodeprojRuby gem, thexcodebuildmcpMCP server, and the core SDK from a public GitHub repository. These downloads are required for the skill's primary functions of project scaffolding and SDK integration.
Audit Metadata