ios-device-support
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPRIVILEGE_ESCALATION
Full Analysis
- [COMMAND_EXECUTION]: The helper script
scripts/find-support.pyexecutes the local command-line utilitiesidevice_idandideviceinfoto identify connected iOS devices and retrieve their operating system versions. The script includes a security check to ensure the device UDID matches a specific alphanumeric regex pattern before it is passed to the execution call. - [EXTERNAL_DOWNLOADS]: The skill facilitates the discovery of iOS DeviceSupport archives from external GitHub repositories (
filsv/iOSDeviceSupportandiGhibli/iOS-DeviceSupport). The instructions explicitly warn the agent against executing remote scripts or using automated installers from these sources, directing the user toward manual verification instead. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from multiple ingestion points, including GitHub API responses (repository trees and commit metadata) and device metadata retrieved via
ideviceinfo. This external content influences the selection and proposal of support files for installation, creating a potential attack surface for indirect prompt injection. - Ingestion points:
scripts/find-support.py(GitHub API calls and device plist parsing). - Boundary markers: The script returns data in structured JSON format, and the
SKILL.mdinstructions utilize logical gates to separate discovery from installation. - Capability inventory: The script uses
subprocess.runfor device identification;SKILL.mdprovides instructions for writing files into Xcode's system directories. - Sanitization: The script performs regex validation on the device UDID and type-checking on JSON responses from the GitHub API.
- [PRIVILEGE_ESCALATION]: The skill provides instructions for modifying sensitive system directories within the Xcode application bundle (
Platforms/iPhoneOS.platform/DeviceSupport/), which typically requires administrative privileges. The instructions mitigate this risk by requiring explicit user authorization and advising against silent or broad use of administrative commands.
Audit Metadata