xcode-build

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute powerful native macOS CLI utilities including xcodebuild, xcrun simctl, and /usr/bin/log. These tools are used for project building, simulator lifecycle management, app installation, and log streaming.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes output from external sources, such as project scheme lists and real-time application logs, which could theoretically contain malicious instructions.
  • Ingestion points: Command output from xcodebuild -list, xcrun simctl list --json, and /usr/bin/log stream is parsed and used by the agent.
  • Boundary markers: The skill does not implement explicit delimiters or "ignore instructions" warnings when processing tool output.
  • Capability inventory: The agent has access to Bash, file system operations, and Apple's development toolchain.
  • Sanitization: Data is filtered using jq and grep, but there is no specific sanitization for natural language instructions embedded in logs or project metadata.
  • [DYNAMIC_EXECUTION]: The skill facilitates the compilation of Swift and Objective-C source code into executable binaries via xcodebuild and their subsequent execution within the iOS simulator environment using xcrun simctl launch and spawn.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 09:08 AM
Security Audit — agent-trust-hub — xcode-build