combine-framework
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents patterns for ingesting and processing untrusted data, which constitutes a potential attack surface.
- Ingestion points: Data enters the context through
searchTextinSearchViewModel,service.getUsers()inHomeViewModel, andURLSession.shared.dataTaskPublisherinSKILL.md. - Boundary markers: The provided code templates do not include explicit delimiters or sanitization logic to distinguish between data and instructions.
- Capability inventory: The skill demonstrates usage of
URLSessionfor network operations andDispatchQueuefor task scheduling. - Sanitization: There is no evidence of input validation or output escaping in the provided Swift code examples.
- [EXTERNAL_DOWNLOADS]: The documentation references an external testing library.
- The skill recommends using
pointfreeco/combine-schedulersfor testing time-based operators, which is a recognized resource in the Swift development community.
Audit Metadata