cloudkit-schema-source-of-truth
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/ck-schema-dev.shperforms local command execution using the Applexcrun cktoolutility to export, validate, and import CloudKit schema definitions.- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface as it ingests and processes schema definitions from external.ckdbfiles. - Ingestion points: The file
cloudkit/myapp.ckdbis used as an input for thevalidate-schemaandimport-schemacommands inscripts/ck-schema-dev.sh. - Boundary markers: None present in the schema file format.
- Capability inventory: The skill executes shell commands via
cktooland writes to the local filesystem. - Sanitization: The workflow explicitly includes a
validate-schemapre-flight check to verify the integrity and compatibility of the schema file before attempting an import operation.
Audit Metadata