The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes several utility scripts (package_app.sh, sign-and-notarize.sh, compile_and_run.sh) that execute standard macOS development commands such as swift build, codesign, lipo, notarytool, and stapler to automate the build and packaging pipeline.
[CREDENTIALS_UNSAFE]: The notarization script sign-and-notarize.sh handles sensitive App Store Connect API keys by consuming them from environment variables. It safely manages the private key locally by writing it to a temporary file within a restricted-access directory (chmod 700) which is automatically cleaned up on exit using a shell trap.
[EXTERNAL_DOWNLOADS]: The scripts do not perform any remote downloads. They verify the presence of required local tools (like Sparkle's generate_appcast or Xcode's ictool) and prompt the user to install them if missing.
[PROMPT_INJECTION]: The instructions in SKILL.md are focused on technical workflows and do not contain patterns aimed at overriding agent behavior or bypassing safety guidelines.

macos-spm-app-packaging