The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python scripts to wrap the system's xctrace utility for recording and analyzing application traces. The scripts scripts/record_trace.py and scripts/instruments_parser/xctrace.py construct commands using lists passed to subprocess.Popen and subprocess.run, which is a safe practice that prevents shell injection.
[DATA_EXPOSURE]: There is no evidence of sensitive data exposure or exfiltration. The skill interacts with local files, specifically .trace bundles, and temporary files like /tmp/stop-trace. No network-based exfiltration patterns were observed.
[REMOTE_CODE_EXECUTION]: The skill does not perform any remote code execution. All logic is contained within local Python scripts and Markdown documentation. It does not download external scripts or packages from untrusted sources.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data (Instruments .trace files) as part of its analyze_trace.py functionality. While this presents a theoretical injection surface, the processing is limited to parsing performance metrics and does not execute the data content as instructions. This represents a low-risk profile typical of developer tools.
[PERSISTENCE_MECHANISMS]: No persistence mechanisms, such as modifications to shell profiles or scheduled tasks, were detected.

swiftui-expert-skill