bootstrap-ios
Pass
Audited by Gen Agent Trust Hub on Aug 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local shell script
scripts/bootstrap-ios-skills.shwhich the user or agent can run to automate environment setup. The script executes commands such asnpx skills addto register new skills andnpx xcodebuildmcp initto initialize development tools. - [EXTERNAL_DOWNLOADS]: The bootstrap script identifies and fetches multiple iOS-related agent skills from public GitHub repositories. The sources include well-known community members (e.g., twostraws, AvdLee) and established technology services (e.g., Sentry's
getsentry/XcodeBuildMCP). These references are documented and the script includes a dry-run mode for transparency. - [PROMPT_INJECTION]: The skill's primary function involves analyzing local Apple-platform project files (such as
*.xcodeproj,Package.swift, and*.swift). This creates a surface for indirect prompt injection, where malicious content embedded in project metadata or code comments could attempt to influence the agent's behavior. However, the skill maintains a conservative posture and recommends verification steps to mitigate unintended actions.
Audit Metadata