skills/soapbox-pub/ditto/mac-runner/Gen Agent Trust Hub

mac-runner

Pass

Audited by Gen Agent Trust Hub on Jun 24, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill contains numerous shell commands intended for runner management and troubleshooting. These include standard service management (gitlab-runner restart), system configuration (networksetup), and build tool execution (fastlane, xcodebuild). All commands are contextually relevant to the stated purpose of managing CI/CD infrastructure.
  • [CREDENTIALS_UNSAFE]: The documentation references sensitive file paths such as ~/.private_keys/*.p8 (App Store Connect API keys) and ~/.gitlab-runner/config.toml. However, it correctly uses placeholders (e.g., <key-id>, <from GitLab CI variables>) for actual secrets, following security best practices for documentation.
  • [EXTERNAL_DOWNLOADS]: The skill interacts with well-known technology services and repositories, including gitlab.com for health checks and official package registries for npm, npx, and gem. These downloads are performed as part of standard build and maintenance workflows.
  • [PERSISTENCE]: The skill describes the use of a macOS LaunchAgent (~/Library/LaunchAgents/gitlab-runner.plist) to ensure the runner service remains active across reboots. This is a standard and documented persistence mechanism for legitimate background services on macOS.
  • [DYNAMIC_EXECUTION]: Includes a Python one-liner for JSON parsing and a Ruby script snippet for generating JSON Web Tokens (JWT) locally to authenticate with Apple's App Store Connect API. These scripts are functional, transparent, and do not involve untrusted data or remote code execution.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 24, 2026, 03:24 PM
Security Audit — agent-trust-hub — mac-runner