apple-design
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The README.md file contains instructions for installing the Bun runtime via a remote script from its official domain (bun.sh). This is a standard and safe installation procedure for this well-known developer tool.
- [EXTERNAL_DOWNLOADS]: The skill includes a utility script (fetch-apple-hig.mjs) that downloads and updates HIG documentation and illustrations from Apple's official developer portal (developer.apple.com). This script uses the standard fetch API and is intended for maintaining the local documentation database.
- [COMMAND_EXECUTION]: The skill provides a Node.js-based audit engine (audit-apple-design.mjs) that programmatically scans project directories to identify design anti-patterns, such as non-compliant colors, small touch targets, or incorrect easing curves.
- [INDIRECT_PROMPT_INJECTION]: The audit engine analyzes source code from the user's project, creating a surface for indirect data ingestion. 1. Ingestion points: audit-apple-design.mjs traverses the workspace and reads files with extensions like .css, .tsx, and .swift using readFileSync. 2. Boundary markers: None present; the script performs direct regex matching on the raw file content. 3. Capability inventory: The analysis tool performs filesystem read operations (readdirSync, readFileSync) and outputs numerical scores and text-based findings to the agent. 4. Sanitization: No sanitization is implemented as the tool is a design-focused static analyzer.
Audit Metadata