The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/move_to_trash.sh is vulnerable to AppleScript injection. It attempts to delete files using osascript by interpolating the file path into a string with insecure quoting ('"'"$path"'"''). If a file with a maliciously crafted name (e.g., containing single quotes and AppleScript commands) is passed to this script, it could result in the execution of arbitrary AppleScript code, which can be used to execute shell commands via the do shell script command.
[COMMAND_EXECUTION]: The skill's primary workflow involves executing various CLI tools including xcodegen, git, and make. It also executes installation scripts located in sibling directories (../../xcode-makefiles/scripts/install.sh and ../../simple-tasks/scripts/install.sh). This creates a dependency on the security and presence of these external skills and tools.
[COMMAND_EXECUTION]: In scripts/scaffold_app.sh, the skill executes xcodegen generate while dynamically setting environment variables USER and LOGNAME. While typical for project generation, this involves running an external binary with environment manipulation.

app-creator