ios-simulator-skill

Pass

Audited by Gen Agent Trust Hub on Aug 23, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill performs extensive system interactions using the subprocess module to control the iOS simulator via xcrun simctl and idb. The implementation correctly constructs commands as lists and avoids shell interpolation, which effectively mitigates the risk of command injection. These operations are strictly limited to the intended purpose of simulator lifecycle management and app interaction testing.
  • Call sites identified in nearly all automation scripts, such as app_launcher.py, simctl_boot.py, and navigator.py.
  • [DATA_EXFILTRATION]: Scripts including container.py, log_monitor.py, and app_state_capture.py provide capabilities to read application sandbox data, system logs, and UI hierarchies. Analysis confirms these operations are local-only and intended for debugging and testing. No functions or patterns were identified that would allow for the unauthorized transmission of this data to external network addresses. container.py specifically includes checks to prevent path traversal outside the targeted app sandbox.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 23, 2026, 04:00 AM
Security Audit — agent-trust-hub — ios-simulator-skill