macos-initial-access
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides shell script templates (preinstall/postinstall) and guides the AI to generate commands for macOS system utilities like pkgbuild, productbuild, hdiutil, and codesign. These are standard tools used for software distribution and security testing on macOS.
- [COMMAND_EXECUTION]: The scripts/image-to-icns.py utility uses subprocess.run to invoke the sips command for image processing. The implementation follows security best practices by passing arguments as a list to avoid shell injection vulnerabilities.
- [INDIRECT_PROMPT_INJECTION]: The skill contains templates that incorporate user-provided data into executable scripts and configuration files.
- Ingestion points: User-supplied application names, identifiers, and file paths are used to populate Info.plist, Distribution.xml, and shell scripts (references/installer-packages.md).
- Boundary markers: No explicit delimiter markers are used in the provided templates.
- Capability inventory: The generated scripts can create directories, remove files, and launch applications (mkdir, rm, ditto, open).
- Sanitization: The documentation provides explicit warnings to users to avoid deriving critical paths from untrusted input and recommends using fixed destination paths.
- [SAFE]: The scripts/image-to-icns.py script demonstrates defensive programming by using temporary directories for workspace isolation, verifying the presence of system binaries before execution, and using the os.O_EXCL flag to prevent unintended file overwrites.
Audit Metadata