hermes-swift-mac-app
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation includes commands for building the app (
xcodebuild), generating icons (sips), and managing releases (git). It also programmatically executes/usr/bin/sshto establish tunnels for remote server access. - [DYNAMIC_EXECUTION]: The
BrowserWindowController.swiftcode useswebView.evaluateJavaScriptto inject text and base64-encoded images from the system clipboard into the web application context. - [EXTERNAL_DOWNLOADS]: The project defines a dependency on the Sparkle framework (
https://github.com/sparkle-project/Sparkle) for auto-updates, which is a well-known and standard service for macOS applications. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests untrusted data from the system clipboard and injects it into the WebView. This is a functional requirement for the skill's purpose.
Audit Metadata