macos-dmg-builder
Pass
Audited by Gen Agent Trust Hub on Mar 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard macOS development utilities such as xcodebuild, codesign, xcrun, and hdiutil to automate the build and packaging process. These commands are executed within the context of the user's local project directory to produce signed artifacts.\n- [CREDENTIALS_UNSAFE]: The skill handles Apple Developer credentials and app-specific passwords. It correctly implements secure practices by using 'notarytool' to store credentials in the system Keychain and provides instructions for secure, non-echoing interactive input. It explicitly prohibits printing secrets to the console and includes safety rules for secret handling in chat.\n- [REMOTE_CODE_EXECUTION]: No remote scripts or unverified dependencies are downloaded or executed. The skill operates exclusively using local template files provided within the skill assets and system-installed binaries.\n- [DATA_EXFILTRATION]: No suspicious network activity or unauthorized data transmission was identified. Network operations are limited to official Apple services required by macOS tools for the application notarization and stapling process.
Audit Metadata