ClawHub
Back to skill

Security audit

SwiftUI macOS

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only macOS SwiftUI guidance skill with no hidden execution, credential access, or persistence behavior found.

Before installing, understand that this skill may be invoked across many macOS SwiftUI tasks and gives strong, opinionated guidance for modern macOS 26 and Swift 6.2 projects. Review any generated project changes as usual, especially dependency additions or persistence-related app code, but the skill package itself is documentation-only and showed no hidden runtime behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Credential Access

High
Category
Privilege Escalation
Content
## @AppStorage

- Only works inside `View` structs. Does NOT trigger updates inside `@Observable` classes, even with `@ObservationIgnored`.
- Never store sensitive data (passwords, tokens) — use Keychain.

## Identifiable
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill advertises itself for essentially any macOS SwiftUI project work, including building, reviewing, debugging, architecture, and design decisions. That broad trigger can cause over-invocation outside a narrowly scoped need, increasing the chance the agent applies filesystem-backed references and strong prescriptive guidance in situations where a more specialized or safer skill should be used.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Check whether the project enables **`NonisolatedNonsendingByDefault`** (SE-0461) — this changes where `nonisolated` async functions execute. See `references/concurrency.md`.
- Prefer SwiftUI-native solutions. Use AppKit (`NSViewRepresentable`, `NSHostingView`, `NSWindow`) only when SwiftUI has no equivalent.
- **Understand the mechanism.** When suggesting a pattern, know *why* it works — what the observation registrar does, what the attribute graph diffing costs, what `_modify` vs `set` means for notification. Rules without understanding produce cargo-culted code.
- Do not introduce third-party frameworks without asking. Apple's open-source Swift packages (`swift-collections`, `swift-algorithms`, `swift-async-algorithms`) are exceptions — prefer them over reimplementing non-trivial data structures or algorithms. See `references/api.md`.

## Examples
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low
Confidence
79% confidence
Finding
Line L167 uses prescriptive natural language that implies a universal interaction requirement: right-click menus are expected on virtually every interactive element. This is overly absolute guidance rather than a clearly justified platform-specific recommendation, and could push implementations toward unnecessary UI behavior without documenting exceptions or context.

Static analysis

No suspicious patterns detected.