authentication
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill provides boilerplate code for official Apple frameworks (AuthenticationServices, LocalAuthentication, and Security) following standard implementation guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill describes the processing of untrusted external data such as authentication tokens and callback URLs.
- Ingestion points: External data enters the application through identity tokens in
SKILL.md, callback URLs inSKILL.md, and server-generated challenges inreferences/passkeys.md. - Boundary markers: The instructions include explicit security warnings (e.g., "Always validate identityToken signatures against Apple's public keys on your server") to prevent developers from trusting local authentication results without server-side verification.
- Capability inventory: The skill contains documentation and code snippets only; it does not invoke any subprocesses, perform automated network requests, or execute local scripts.
- Sanitization: The instructions require cryptographic verification of assertions and tokens on a relying-party server before a session is issued.
Audit Metadata