swiftui-animation-match

Pass

Audited by Gen Agent Trust Hub on Aug 13, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [PROMPT_INJECTION]: The skill processes code from external repositories (e.g., Shubham0812/SwiftUI-Animations), which creates an indirect prompt injection surface where malicious instructions could potentially be embedded in code comments to influence the agent during the 'lift' process.
  • Ingestion points: The catalog at references/catalog-shubham0812-swiftui-animations.md explicitly instructs the agent to 'Read the actual source before lifting'.
  • Boundary markers: The skill utilizes a 'Matching Playbook' and 'Restraint rules' to guide agent behavior, though it does not implement formal technical delimiters for the external code being read.
  • Capability inventory: The agent's primary capability in this context is generating and adapting SwiftUI code based on the patterns it identifies in the external files.
  • Sanitization: The instructions emphasize that the agent must 'Adapt, never paste' and modernize the code (e.g., converting Timers to .phaseAnimator), which serves as a manual sanitization step.
  • [EXTERNAL_DOWNLOADS]: The skill references and fetches content from well-known services to populate its catalogs.
  • Evidence: The catalog and source index files reference the legitimate GitHub repository https://github.com/Shubham0812/SwiftUI-Animations.
  • Evidence: The maintenance guide in references/adding-a-source.md provides a workflow for using git clone to retrieve content for analysis.
  • [COMMAND_EXECUTION]: Standard administrative and development commands are used for managing and validating the skill's data sources.
  • Evidence: adding-a-source.md contains instructions for using git clone and git log to track source revisions.
  • Evidence: The extension instructions mention running a local validation script (scripts/validate-skill-metadata.py) to ensure metadata integrity.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 13, 2026, 12:40 PM
Security Audit — agent-trust-hub — swiftui-animation-match