The Agent Skills Directory

[SAFE]: The skill implements strong security controls for CI/CD environments, specifically utilizing unique, file-based keychains for each job to ensure signing identities remain isolated and are not persisted in the global user keychain.
[SAFE]: Security-positive practices such as using umask 077 and set +x are mandated during sensitive keychain operations to prevent credential exposure in shell logs or via improper file permissions.
[SAFE]: The skill provides explicit instructions to prevent the exfiltration of private signing assets, such as .p12 certificates, .p8 authentication keys, and keychain files, ensuring they remain within the authorized remote environment.
[SAFE]: The included build settings inspector (scripts/inspect-signing-settings.py) uses a strict allowlist and size limits (8 MiB) when parsing JSON data, effectively mitigating risks associated with malformed or malicious build configuration inputs.
[SAFE]: Remote agent communication via MCP is configured using secure SSH transports (ssh -T) with mandatory host-key verification and no PTY allocation, maintaining the integrity of the communication channel.

remote-xcode-signing