local-archive-export-upload

Pass

Audited by Gen Agent Trust Hub on Sep 14, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the Bash tool to execute xcodebuild and xcrun commands for application archiving, exporting, and uploading processes.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for shell commands that interpolate user-provided values without providing instructions for sanitization or validation.
  • Ingestion points: Placeholders such as <Scheme>, <keyID>, and <issuerID> in SKILL.md are intended to be filled by the agent using potentially untrusted input.
  • Boundary markers: The skill does not define specific delimiters or instructions to prevent the agent from executing malicious payloads embedded in the provided strings.
  • Capability inventory: The skill enables the use of xcodebuild and xcrun through the Bash tool, which allows for complex build system operations and network uploads to Apple services.
  • Sanitization: No mention of input validation or escaping mechanisms is included to ensure that user-provided values do not alter the intended command structure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 14, 2026, 03:05 AM