SwiftUI Empty App Init

• Verdict: Pass
• Analyzed: May 12, 2026, 3:01 AM
• Findings: 0
• Version: 1.0.0
• Hash: ba7e85f9d7370dcb4ea24798ba03555efaf30bf7c64fa4506827bada1f557cbf
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: swiftui-empty-app-init Version: 1.0.0 The skill's instructions in SKILL.md are clearly aligned with its stated purpose of initializing a minimal SwiftUI iOS app using XcodeGen. It explicitly limits the agent's actions, instructing it to 'Do not attempt alternative scaffolding or auto-installation' for prerequisites and 'Do not boot simulators, build, install, or launch unless explicitly requested' for verification. There is no evidence of prompt injection attempting to expand the agent's scope, exfiltrate data, execute arbitrary commands, or establish persistence. The required file operations and command executions (e.g., `xcodegen`) are directly necessary for the skill's legitimate function.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI04: Agentic Supply Chain Vulnerabilities

NoteHigh Confidence

What this means

The generated project will depend on whatever XcodeGen installation is already on the user's machine.

Why it was flagged

The skill depends on locally installed developer tooling, especially XcodeGen, but it does not install or fetch tools itself and tells the agent to stop if prerequisites are missing.

Skill content

- Xcode installed and selected via `xcode-select`
- **XcodeGen** available on `PATH`

If any prerequisite is missing:
- Stop execution
- Tell the user exactly what is missing
- Do **not** attempt alternative scaffolding or auto-installation

Recommendation

Install XcodeGen from a trusted source and verify it is the expected version before using the skill.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

The skill may create or update project files in the current working directory once invoked with the required inputs.

Why it was flagged

The skill directs the agent to create files and run XcodeGen without extra confirmation after required inputs are provided; this is expected for project initialization but still mutates the current directory.

Skill content

Proceed immediately once required inputs are provided (do not ask extra confirmations)
...
- Create a minimal `project.yml` using the provided inputs
- Generate `YourApp.xcodeproj` using XcodeGen

Recommendation

Run it in an empty or intended project directory, and keep backups if similarly named files already exist.