build-and-run-macos-app
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill generates a shell script (
script/build_and_run.sh) at runtime based on the detected project type (Xcode vs SwiftPM) and executes it to build and launch the application. This behavior is consistent with the skill's primary stated purpose of automating build workflows. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it processes external data from the repository structure.
- Ingestion points: Detection of Xcode workspace, Xcode project, or SwiftPM package files in the local repository.
- Boundary markers: None identified in the provided instructions.
- Capability inventory: File system writes (creating
script/build_and_run.sh), process termination (killapp before relaunch), and application execution (/usr/bin/open -n). - Sanitization: No specific sanitization or validation of the repository metadata is mentioned before it is used to construct the script commands.
Audit Metadata