combine-framework

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting and processing untrusted data, which constitutes a potential attack surface.
  • Ingestion points: Data enters the context through searchText in SearchViewModel, service.getUsers() in HomeViewModel, and URLSession.shared.dataTaskPublisher in SKILL.md.
  • Boundary markers: The provided code templates do not include explicit delimiters or sanitization logic to distinguish between data and instructions.
  • Capability inventory: The skill demonstrates usage of URLSession for network operations and DispatchQueue for task scheduling.
  • Sanitization: There is no evidence of input validation or output escaping in the provided Swift code examples.
  • [EXTERNAL_DOWNLOADS]: The documentation references an external testing library.
  • The skill recommends using pointfreeco/combine-schedulers for testing time-based operators, which is a recognized resource in the Swift development community.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 08:10 PM
Security Audit — agent-trust-hub — combine-framework