App Intents Code Review

Reviews App Intents code for intent structure, entities, shortcuts, and parameters. Use when reviewing code with import AppIntents, @AppIntent, AppEntity, Ap...

Security Scan

The skill is internally consistent for a code‑review helper: it only contains review guidance and asks the agent to inspect repository files—no installs, credentials, or external endpoints are requested.

Purpose & Capability

Name/description (App Intents code review) align with the contents: the skill is instruction-only and includes detailed references/checklists for AppIntent, entities, parameters, and shortcuts. It does not request unrelated binaries, credentials, or platform access.

Instruction Scope

Runtime instructions correctly require reading repository code (files, surrounding types, and project artifacts like target membership or deployment target) which is necessary for a code review. Minor inconsistency: the hard gate references ../review-verification-protocol/SKILL.md but that file is not present in the provided manifest, so the full pre-report protocol is unavailable from the package itself.

Install Mechanism

No install spec and no code files to run; instruction-only skills have minimal disk/write footprint. This is the lowest-risk install posture.

Credentials

The skill declares no required environment variables, no credentials, and no config paths. The SKILL.md also does not instruct access to secrets or remote endpoints—only to repository files and Xcode/package metadata relevant to App Intents review.

Persistence & Privilege

always is false (no forced inclusion). The skill can be invoked autonomously by agents by default, which is normal; it does not request persistent presence or to modify other skills or system settings.

Assessment

This skill is a review checklist and reference bundle; it only asks the agent to read your repository files and project metadata (which is expected for a code reviewer). Before installing, consider: (1) you are granting the agent access to read code in repos the agent can see—do you trust the agent/host to inspect those files? (2) the skill references a verification protocol file (../review-verification-protocol/SKILL.md) that is not included; if you rely on the hard-gate verification steps, ask the publisher for the missing file or inspect their review process yourself. No credentials, installs, or external network endpoints are requested by this skill, so its technical footprint is minimal.

Quick Reference

Issue Type	Reference
AppIntent protocol, perform(), return types	references/intent-structure.md
AppEntity, EntityQuery, identifiers	references/entities.md
AppShortcutsProvider, phrases, discovery	references/shortcuts.md
@Parameter, validation, dynamic options	references/parameters.md

Review Checklist

• perform() marked with @MainActor if accessing UI/main thread resources
• perform() completes within 30-second timeout (no heavy downloads/processing)
• Custom errors conform to CustomLocalizedStringResourceConvertible
• EntityQuery.entities(for:) handles missing identifiers gracefully
• EntityStringQuery used if Siri voice input needed (not plain EntityQuery)
• suggestedEntities() returns reasonable defaults for disambiguation
• AppShortcut phrases include .applicationName parameter
• Non-optional @Parameter has sensible defaults or uses requestValue()
• @IntentParameterDependency not used on iOS 16 targets (crashes)
• Phrases localized in AppShortcuts.strings, not Localizable.strings
• App Intents defined in app bundle, not Swift Package (pre-iOS 17)
• isDiscoverable = false for internal/widget-only intents

When to Load References

• AppIntent protocol implementation -> intent-structure.md
• Entity queries, identifiers, Spotlight -> entities.md
• App Shortcuts, phrases, discovery -> shortcuts.md
• Parameter validation, dynamic options -> parameters.md

Review Questions

1. Does perform() handle timeout limits for long-running operations?
2. Are entity queries self-contained (no @Dependency injection in Siri context)?
3. Do phrases read naturally and include the app name?
4. Are SwiftData models passed by persistentModelID, not directly?
5. Would migrating from SiriKit break existing user shortcuts?

Hard gates (before reporting)

Complete in order for each finding you intend to report. Do not advance until the pass condition is satisfied.

1. Location artifact — The finding includes [FILE:LINE] (or a line range) copied from the current file contents; the path resolves in this repo.
2. Scope read — You read the full surrounding type: the AppIntent / AppEntity / EntityQuery / AppShortcutsProvider (or equivalent) that contains the flagged code, not only a diff hunk or snippet.
3. Platform or integration claim (only if the finding depends on minimum iOS, Swift Package vs app target, @IntentParameterDependency availability, SiriKit migration, or isDiscoverable / extension placement) — You name one concrete artifact you inspected (for example IPHONEOS_DEPLOYMENT_TARGET or target membership in the Xcode project, Package.swift platforms, entitlements, or where the intent file lives) or you drop or downgrade the finding to an open question.
4. Protocol — Pre-report steps in review-verification-protocol are satisfied for this item (no finding if they are not).

Use the issue format [FILE:LINE] ISSUE_TITLE for each reported finding. Hard gate 4 is the full pre-report checklist for this skill’s review type.