compare-builds

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [SAFE]: No malicious behavior detected. The skill facilitates build analysis using the Tuist CLI, which is the official tool provided by the skill's author. All commands used, such as tuist build show and tuist build list, are standard for the intended use case of monitoring and comparing Xcode build metrics.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides an attack surface by ingesting and processing JSON output from external CLI commands.\n
  • Ingestion points: The agent is instructed to read the JSON output from tuist build show, tuist build xcode target list, tuist build xcode issue list, and tuist build xcode cache-task list (SKILL.md).\n
  • Boundary markers: No explicit delimiters or instructions to ignore embedded content within the JSON data are provided.\n
  • Capability inventory: The skill utilizes shell command execution for tuist and git commands (SKILL.md).\n
  • Sanitization: The skill relies on the structured JSON format of the Tuist CLI output for data processing.\n
  • Analysis: Since the data originates from the user's own build environment via the vendor's trusted CLI tool, the risk of malicious instruction injection via build logs is considered negligible.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 04:09 PM