flow-walkthrough
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured framework for auditing navigation graphs and driving automated UI tests. It uses standard iOS development tools such as
xcodebuild,xcrun xcresulttool, andXCUITest. - [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands for building and testing the app. These commands use local environment variables (like project names and device IDs) derived from the user's codebase. This is a standard and necessary function for the skill's stated purpose.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from
PLAN.md(specifically<flows>blocks) and the project source code to generate tests and audits. While this represents a surface for indirect prompt injection if those files were maliciously crafted by an attacker, the risk is inherent to any development tool processing source files, and the skill provides a human review step (Layer 3) to validate results. - [DATA_EXFILTRATION]: No network operations or attempts to exfiltrate sensitive data were detected. The skill writes results to a local
.planning/directory within the workspace. - [OBFUSCATION]: No obfuscated code, hidden characters, or encoded strings were found.
Audit Metadata