Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward SwiftLint helper skill with disclosed linting, install, reporting, configuration, and autocorrect commands; the main practical risk is that autocorrect can edit source files.
Install this only for Swift projects where you want SwiftLint assistance. Treat `swiftlint --fix` as a file-modifying command, review your git diff afterward, and be cautious with workflow examples that use `git stash`, branch checkout, or `sudo xcode-select`.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
swiftlint rules | grep "force_cast"
### Show Rule Details
```bash
swiftlint rules force_cast
The trigger guidance uses broad natural-language phrases like 'check my code style' or 'lint my Swift code' to authorize running commands. In an agent environment, such generic phrasing can cause unintended invocation against the current project or directory without sufficient scoping, especially when the user did not explicitly request tool execution.
The skill explicitly instructs the agent to run swiftlint --fix, which modifies repository files, but the guidance does not require an explicit user confirmation immediately before making changes. In an agent setting, linting may be expected to be read-only, so automatically switching to write actions can cause unintended code edits, dirty working trees, or disruptive changes in the user's project.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
swiftlint lint --reporter github-actions-logging
### Xcode Summary (plist)
```bash
swiftlint lint --reporter xcode-summary
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| `emoji` | Emoji-decorated | Fun terminal output |
| `html` | HTML report | Browser viewing |
| `junit` | JUnit XML | Test reporting tools |
| `xcode-summary` | Plist | Xcode build summaries |
> **Agent guidance:** Use `--reporter json` when you need to parse results programmatically. Use `--reporter github-actions-logging` on GitHub Actions to get inline annotations on PRs.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|---|---|
| `No lintable files found` | Check `included` paths in config or run from project root |
| `Invalid configuration` | Validate YAML syntax in `.swiftlint.yml` |
| `SourceKit not found` | Run `sudo xcode-select -s /Applications/Xcode.app` |
| `Rule not found` | Check rule name with `swiftlint rules`, may be opt-in |
| `Slow linting` | Add `excluded` paths for Pods/DerivedData, use `--cache-path` |
The note says that when a user asks to 'clean up' or 'fix style' in Swift code, the agent should run swiftlint --fix first, which combines a vague trigger with immediate write actions. This makes unintended modification especially likely because ordinary conversational requests can be interpreted as authorization to alter source files.
No suspicious patterns detected.