build-iphone-apps
Fail
Audited by Gen Agent Trust Hub on Feb 16, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION] (HIGH): The verification loop executes shell commands including
xcodebuild -scheme AppNameandxcrun simctl launch booted com.company.AppName. These parameters are derived from user-provided project metadata. Without explicit sanitization or strict boundary markers, this provides a direct path for shell command injection via specially crafted project or scheme names. - [REMOTE_CODE_EXECUTION] (HIGH): The skill's primary function is to generate and compile Swift code based on untrusted user descriptions. This represents a 'Tier: HIGH' Indirect Prompt Injection surface where the agent acts as an automated 'execute/write' component for external content, lacking necessary sanitization or human-in-the-loop validation for the generated logic.
- [EXTERNAL_DOWNLOADS] (MEDIUM): The verification logic pipes build output to a tool named
xcsift(xcodebuild ... | xcsift). This utility is not a standard component of the Xcode command-line tools or macOS. Its source, integrity, and safety are unverifiable, posing a supply-chain risk if the environment requires manual installation of this dependency. - [CREDENTIALS_UNSAFE] (LOW): Automated scans flagged
com.appas a phishing-related domain. This string is used as a placeholder bundle identifier in thexcrun simctlcommand. While intended as a placeholder, its use in executable strings matches patterns associated with malicious URL delivery.
Recommendations
- AI detected serious security threats
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata