ios-marketing-capture-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation instructions that download content from a third-party GitHub repository (
ParthJadhav/ios-marketing-capture) vianpxorgit clone.- [COMMAND_EXECUTION]: The skill generates a shell script (capture-marketing.sh) designed to execute development and simulator management commands includingxcodebuild,xcrun simctl, anddefaults.- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user inputs (such as locales, device names, and app identifiers) and interpolates them directly into shell scripts and Swift source code templates. - Ingestion points: User-defined parameters for locales, device model, and app name used in script generation.
- Boundary markers: None identified; parameters are directly interpolated into script strings.
- Capability inventory: The generated scripts perform file system operations (cp, rm), build operations (xcodebuild), and simulator management (simctl).
- Sanitization: No explicit sanitization or validation of user-provided strings is evident in the templates before interpolation.- [DYNAMIC_EXECUTION]: The skill generates and writes executable shell scripts and Swift source files at runtime based on user requirements.
Audit Metadata