The Agent Skills Directory

[DYNAMIC_EXECUTION]: The mac_release_expand function in scripts/lib/mac_release.sh uses eval to process variables from the .mac-release.env manifest (e.g., APP_ZIP, FEED_URL). This permits shell command substitution (e.g., $(command)) if the manifest file contains malicious content.
[INDIRECT_PROMPT_INJECTION]: The skill ingests configuration and release notes from repository-owned files such as .mac-release.env and CHANGELOG.md. This represents a vulnerability surface where a compromised or untrusted repository could trigger arbitrary command execution through the eval vector or by defining a malicious build command.
[COMMAND_EXECUTION]: The script executes a build command specified in the MAC_RELEASE_PACKAGE_CMD manifest variable. While this is the intended primary purpose of the skill, it allows the repository to dictate the commands executed by the agent.
[DYNAMIC_EXECUTION]: The 1Password integration (mac_release_load_1password_env) dynamically generates and executes temporary Bash and Node.js scripts in /tmp to handle credential parsing and retrieval.
[SAFE]: The skill implements significant security hardening at its entry point (scripts/mac-release), including the use of bash -p (privileged mode) to ignore BASH_ENV and other startup hooks, environment scrubbing to remove exported functions, and unsetting potentially dangerous shell variables like CDPATH and GLOBIGNORE.
[SAFE]: Sensitive data such as 1Password service tokens and private keys are handled with restrictive file permissions (umask 077, chmod 600) and are kept out of the process tree through the use of temporary files and isolated tmux sessions.

release-mac-app