ios-simulator-skill
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs extensive system interactions using the
subprocessmodule to control the iOS simulator viaxcrun simctlandidb. The implementation correctly constructs commands as lists and avoids shell interpolation, which effectively mitigates the risk of command injection. These operations are strictly limited to the intended purpose of simulator lifecycle management and app interaction testing. - Call sites identified in nearly all automation scripts, such as
app_launcher.py,simctl_boot.py, andnavigator.py. - [DATA_EXFILTRATION]: Scripts including
container.py,log_monitor.py, andapp_state_capture.pyprovide capabilities to read application sandbox data, system logs, and UI hierarchies. Analysis confirms these operations are local-only and intended for debugging and testing. No functions or patterns were identified that would allow for the unauthorized transmission of this data to external network addresses.container.pyspecifically includes checks to prevent path traversal outside the targeted app sandbox.
Audit Metadata