debug-generated-project
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly asks users to provide their Project.swift/Tuist.swift content and a reproduction project (user-supplied files) which the agent will read and run, and it clones a public GitHub repository (https://github.com/tuist/tuist.git), so it ingests untrusted third‑party/user-generated content as part of its workflow.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The skill instructs cloning and building the Tuist repository at runtime from https://github.com/tuist/tuist.git, which fetches remote source that is then built and executed locally, so it is a runtime external dependency that can execute code.
Audit Metadata