The Agent Skills Directory

[COMMAND_EXECUTION]: The skill extensively uses subprocess.run to interact with system tools like xcrun, idb, and xcodebuild. It constructs command arrays from agent-provided inputs such as bundle IDs, launch arguments, and file paths. This creates a potential for argument injection if malicious strings are passed to the underlying binaries. Additionally, scripts like scripts/container.py allow exporting simulator data to arbitrary host paths, granting the agent file-write capabilities on the host system.
[PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection. • Ingestion points: It reads untrusted data from the simulator environment, including application logs (scripts/log_monitor.py), UI accessibility trees (scripts/screen_mapper.py), and sandbox files (scripts/container.py). • Boundary markers: No delimiters or ignore-instructions warnings are used when presenting this data to the agent. • Capability inventory: The skill possesses extensive capabilities for simulator management, app installation, and local file operations. • Sanitization: Ingested strings are not sanitized. This allows a malicious app within the simulator to potentially influence agent behavior through log output or accessibility labels.

ios-simulator-skill