apple-dev-safety-and-docs
Pass
Audited by Gen Agent Trust Hub on Mar 1, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a shell script (
detect_xcode_managed_scope.sh) to locate Xcode-related files (.xcodeproj,.xcworkspace) within a specified directory. This is used to trigger safety warnings before direct file mutations. - [COMMAND_EXECUTION]: A Python script (
advisory_cooldown.py) is used to manage a local state file at~/.codex/state/apple_dev_advisory_cooldowns.json. This script tracks timestamps to ensure that advisory messages regarding documentation are not shown more than once every 21 days. - [EXTERNAL_DOWNLOADS]: The documentation in
references/skills-installation.mdprovides instructions for the user to install additional skills usingnpx. These references point to the author's own repository (gaelic-ghost/apple-dev-skills) and a trusted community repository (vercel-labs/agent-skills). - [DATA_EXPOSURE]: The skill interacts with local project metadata (file paths) and a local state file for cooldowns. No network exfiltration or access to sensitive credentials (like SSH keys or API tokens) was identified.
Audit Metadata