cloudkit
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill follows established Apple developer patterns for data synchronization and conflict resolution. It correctly uses secure coding practices for data persistence (NSSecureCoding) and error handling (CKError). All code examples utilize standard system frameworks without external or unverifiable dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill describes processing data from external sources (CloudKit databases), which inherently involves untrusted data ingestion. However, the risk is mitigated as the instructions focus purely on data synchronization and merge logic rather than using the content for instruction execution.
- Ingestion points: Records are fetched via
CKDatabase.records(matching:)inSKILL.mdand tracked viaCKFetchRecordZoneChangesOperationinreferences/cloudkit-patterns.md. - Boundary markers: None present in code snippets.
- Capability inventory: File system operations via
FileManager.setUbiquitousandCKAssetmanagement; UI presentation viaUICloudSharingController. - Sanitization: None present; the skill prioritizes three-way merge logic for data integrity over content validation.
Audit Metadata