ios-simulator-skill
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- PROMPT_INJECTION (HIGH): High surface area for Indirect Prompt Injection (Category 8).
- Ingestion points:
screen_mapper.py(UI text),log_monitor.py(app logs), andpush_notification.py(payloads). - Boundary markers: None described.
- Capability inventory:
app_launcher.py(install/uninstall),privacy_manager.py(grant/revoke permissions),simctl_delete.py(device deletion). - Sanitization: None described. An attacker-controlled app could display malicious instructions in the UI or logs to hijack the agent via these high-privilege tools.
- COMMAND_EXECUTION (MEDIUM): The skill executes 21 different Python and Bash scripts that interface with host-level utilities like
simctlandidb. This is inherent to the skill's purpose but presents a broad attack surface if the agent is manipulated into passing malicious arguments to these scripts.
Recommendations
- AI detected serious security threats
Audit Metadata