ios-memgraph-leaks
Pass
Audited by Gen Agent Trust Hub on Jun 14, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands using standard Apple developer utilities (
leaks,xcrun simctl) to debug iOS applications. - The shell script
scripts/capture_sim_memgraph.shproperly quotes variables and usesset -euo pipefailto ensure robust and safe execution. - The Python script
scripts/summarize_memgraph_leaks.pyusessubprocess.runwith a list of arguments, which is the recommended practice to avoid shell interpolation and command injection vulnerabilities. - [PROMPT_INJECTION]: The skill parses and summarizes output from memory analysis tools which may contain strings (such as class names) from the target application being debugged, creating a surface for indirect prompt injection.
- Ingestion points:
scripts/summarize_memgraph_leaks.pyprocesses raw output from theleaksutility. - Boundary markers: The script wraps tool output within triple-tilde (
~~~text) code blocks in the generated markdown report to ensure the agent treats the content as data rather than instructions. - Capability inventory: The skill facilitates capturing and reading memory graphs via local system commands.
- Sanitization: The script extracts specific fields via regex while preserving the structural integrity of the report, minimizing the risk of instructions being interpreted as valid commands.
- [SAFE]: No network operations, sensitive file access (such as credentials or SSH keys), or obfuscation techniques were identified in the skill files.
Audit Metadata