xcode-build
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
Bashtool to execute powerful native macOS CLI utilities includingxcodebuild,xcrun simctl, and/usr/bin/log. These tools are used for project building, simulator lifecycle management, app installation, and log streaming. - [INDIRECT_PROMPT_INJECTION]: The skill processes output from external sources, such as project scheme lists and real-time application logs, which could theoretically contain malicious instructions.
- Ingestion points: Command output from
xcodebuild -list,xcrun simctl list --json, and/usr/bin/log streamis parsed and used by the agent. - Boundary markers: The skill does not implement explicit delimiters or "ignore instructions" warnings when processing tool output.
- Capability inventory: The agent has access to
Bash, file system operations, and Apple's development toolchain. - Sanitization: Data is filtered using
jqandgrep, but there is no specific sanitization for natural language instructions embedded in logs or project metadata. - [DYNAMIC_EXECUTION]: The skill facilitates the compilation of Swift and Objective-C source code into executable binaries via
xcodebuildand their subsequent execution within the iOS simulator environment usingxcrun simctl launchandspawn.
Audit Metadata