Xcode

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:04 PM UTC
• Version: 1.0.0

Overview

This Xcode troubleshooting skill is mostly coherent, but it recommends broad destructive cleanup commands without warning or confirmation.

Review before installing. The skill is not showing signs of credential theft or hidden execution, but an agent using it may suggest or run broad cleanup steps. Confirm before deleting DerivedData, and avoid `xcrun simctl erase all` unless you intend to wipe all simulator data; prefer targeting a specific simulator device.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:48

Finding

Destructive Reset of All Simulator Data Without Confirmation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: Destructive command with excessive scope and no confirmation safeguard
Risk Level: Medium

Vulnerable Code

markdown

- Simulator stuck — `xcrun simctl shutdown all`, then `xcrun simctl erase all`

Technical Analysis

The recommended xcrun simctl erase all command resets every available simulator rather than limiting the operation to the malfunctioning simulator. Erasure can destroy application data, test state, locally stored credentials, configuration, and debugging artifacts across unrelated simulator environments.

The instruction does not warn that erasure is destructive, require explicit user confirmation, recommend preserving relevant data, or first identify the affected simulator. Although the command does not grant additional privileges, its unnecessarily broad scope violates least-destructive-operation principles.

Attack Path

1. A user asks an Agent using this Skill to resolve one stuck simulator.
2. The Skill recommends shutting down and erasing all simulators.
3. The Agent executes xcrun simctl shutdown all.
4. The Agent executes xcrun simctl erase all without requesting confirmation.
5. Data and state belonging to every available simulator are erased, including unrelated development and test environments.

Impact Assessment

The command operates with the invoking user's existing permissions and does not provide privilege escalation. Its impact is confined to simulator environments accessible to that user, but it can cause broad local data loss and disrupt unrelated development, testing, and debugging activities. Potentially affected assets include simulator application data, test fixtures, authentication state, configuration, and forensic artifacts.

Remediation

View remediation

Remediation Suggestions

Replace the broad reset procedure with a targeted and confirmation-gated workflow:

1. List simulator devices and identify the affected device and UDID:

   bash

   xcrun simctl list devices
   

2. Attempt a targeted shutdown first:

   bash

   xcrun simctl shutdown <DEVICE_UDID>
   

3. Clearly warn the user that erasure permanently removes the selected simulator's data.
4. Obtain explicit confirmation immediately before performing erasure.
5. Erase only the affected simulator:

   bash

   xcrun simctl erase <DEVICE_UDID>
   

6. Recommend preserving any necessary test data or debugging artifacts before erasure.
7. Reserve erase all for exceptional cases where every simulator is known to require a reset, with a separate explicit confirmation of its global scope.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

## Signing Issues
- "Automatic" signing still needs team selected — set in Signing & Capabilities
- Provisioning profile mismatch — bundle ID must match exactly, including case
- "No signing certificate" — open Keychain, check certificate is valid and not expired
- Device not registered — add UDID in developer portal, regenerate profile
- CI/CD needs manual signing — automatic doesn't work in headless builds

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

## CLI Builds
- `xcodebuild -showBuildSettings` to debug — see resolved values
- `-allowProvisioningUpdates` for CI with auto-signing — needs keychain access
- `-destination` must be exact — `platform=iOS Simulator,name=iPhone 15`
- `xcrun altool` deprecated — use `xcrun notarytool` for notarization

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill recommends deleting Xcode DerivedData as a fix but does not warn that this is a destructive cleanup step that can remove caches, indexes, and other local build artifacts, causing data loss of debugging context and workflow disruption. In an agent setting, presenting destructive file deletion without confirmation or safer alternatives increases the chance of unnecessary or automated harmful actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The command xcrun simctl erase all irreversibly wipes simulator device data, and the skill presents it as a routine fix without warning about the destructive effect. In a troubleshooting skill, that omission is dangerous because users or agents may execute it reflexively, losing app state, test data, and local debugging environments.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes the skill's purpose in general terms but does not define explicit trigger phrases, invocation conditions, or exclusions. Without clear scope boundaries or negative examples, the skill may be invoked for broad everyday Xcode-related requests rather than a narrowly defined context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.