Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent SwiftUI/FOSMVVM app setup template with no hidden execution or agent-level persistence.
Before installing, review generated App struct output for correct production/staging/debug URLs, resource bundles, test view registrations, and optional UI choices such as forced dark mode. The reviewed artifact does not show hidden execution, credential access, destructive actions, or host-level persistence.
The skill explicitly states it will derive configuration from broad 'conversation context' and 'codebase analysis' without narrowly constraining trusted inputs. In an agent setting, that creates prompt/input ambiguity that can let unrelated or adversarial prior messages influence generated app configuration such as deployment URLs, resource bundles, or test behavior.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
// Deployment Notes:
//
// For release builds, the deployment environment is configured via Info.plist:
//
// 1. The CI pipeline sets the FOS_DEPLOYMENT build setting (e.g., "staging" or "production")
// 2. Info.plist contains: FOS-DEPLOYMENT = $(FOS_DEPLOYMENT)
This markdown file includes natural-language and code-template guidance that explicitly forces a specific presentation mode via .environment(\.colorScheme, .dark). Under the policy rule, hard-coding a user-facing preference without opt-in is a natural-language policy concern because the template instructs downstream apps to enforce a fixed setting rather than allowing user choice.
The example applies .preferredColorScheme(ColorScheme.dark), which directs adopters toward enforcing a fixed UI mode. This is a policy-style violation because it constrains user-facing preference behavior without any indication that users can choose their own appearance setting.
This line reinforces a hard-coded dark appearance through environment injection, again presenting a fixed user-facing preference as default template behavior. Because no opt-in, alternative, or justification is provided, it fits the policy category for forced language/locale-style preference constraints.
The manifest describes this skill as setting up the @main App struct, MVVMEnvironment, deployment URLs, and test infrastructure. The example under 'Pattern 1' adds a write to UserDefaults (UserDefaults.standard.set(...)), which is a separate persistence capability not justified as part of the stated setup purpose and could encourage consumers to add behavior beyond the skill's declared scope.
No suspicious patterns detected.