The Agent Skills Directory

[COMMAND_EXECUTION]: The skill includes Python scripts (record_trace.py, analyze_trace.py) that invoke the system utility xctrace via the subprocess module. This is used solely for recording and exporting Instruments traces to analyze app performance, which is the primary purpose of the skill. The scripts use the list-based argument format for subprocess.Popen and subprocess.run, which follows security best practices to prevent shell injection.
[INDIRECT_PROMPT_INJECTION]: The skill contains logic for parsing XML data exported from Instruments traces. It uses standard XML parsing libraries to extract metadata such as view names, symbols, and timing information. This processing is performed locally on user-generated performance data and does not expose the agent to untrusted external content.
[DATA_EXPOSURE]: The profiling scripts demonstrate security awareness by explicitly redacting environment variables when logging commands to be executed: display.append(f"{key}=<redacted>" if key else "<redacted>"). This prevents accidental exposure of sensitive environment data in the agent's logs.

liquid-glass-motion