The Agent Skills Directory

[COMMAND_EXECUTION]: The function mac_release_expand uses the eval command to perform shell expansion on manifest variables. If a repository's manifest contains malicious subshell syntax (e.g., $(command)), those commands will be executed during the manifest loading process.
[COMMAND_EXECUTION]: The skill sources the repo-owned .mac-release.env file and additional files specified in MAC_RELEASE_SOURCE_FILES. This directly executes any shell code contained within those repository files.
[COMMAND_EXECUTION]: Release hooks such as MAC_RELEASE_PACKAGE_CMD and MAC_RELEASE_PRECHECK are executed via bash -c, enabling the repository to run arbitrary shell scripts on the host system during the build and packaging phases.
[EXTERNAL_DOWNLOADS]: The skill utilizes curl to download application artifacts from remote URLs defined in the manifest for the purpose of verifying signatures and enclosure integrity.
[PRIVILEGE_ESCALATION]: The skill modifies system security settings using the security utility, specifically altering the user's keychain search list and private key partition ACLs to facilitate automated, non-interactive code signing.

release-mac-app