ios-simulator
Warn
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
- [PRIVILEGE_ESCALATION]: The skill documents a recovery procedure that involves executing commands with root privileges to terminate system services.
- Evidence: 'references/command-reference.md' lists the command 'sudo killall -9 com.apple.CoreSimulator.CoreSimulatorService' as a way to restart the simulator service.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides instructions for identifying and accessing the file system paths of application sandboxes and the simulator's keychain.
- Evidence: 'SKILL.md' explains how to use 'xcrun simctl get_app_container' to retrieve the local directory for an app's data, including its Documents and Library folders.
- Evidence: 'SKILL.md' and 'references/command-reference.md' describe using 'xcrun simctl keychain ... add-root-cert' to install root CA certificates into the simulator's trust store.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external data payloads for push notifications, creating an attack surface where maliciously crafted data could influence application behavior or test outcomes.
- Ingestion points: The 'xcrun simctl push' command reads data from local JSON files or stdin ('SKILL.md').
- Boundary markers: The instructions do not recommend the use of delimiters or validation to prevent the agent from obeying instructions embedded within the push payload.
- Capability inventory: The skill can launch applications, inject environment variables, and modify privacy settings.
- Sanitization: No sanitization or schema validation steps are provided for the incoming push payloads.
Audit Metadata