Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward SwiftUI app generator that discloses its generated-project output and QA handoff, with no evidence of hidden, destructive, persistent, or credential-seeking behavior.
Installers should expect this skill to create generated project files under dev-output and to hand the generated code to qa-skill for review. Avoid feeding highly sensitive PRDs unless you are comfortable with that generated-code QA workflow.
The skill explicitly states it will 'automatically trigger qa-skill' but does not define clear user-consent, scope, or boundary conditions for invoking another skill. Unconstrained cross-skill chaining can propagate sensitive project content to additional agents or cause unintended actions beyond the user's expectation, which is especially risky in an automated development workflow.
The skill says it will create a complete Xcode project in dev-output/ but does not clearly warn that it writes files to disk or define limits on what may be created or overwritten. Silent filesystem writes can surprise users, overwrite existing work, or create a staging point for unsafe generated artifacts in environments where agents have broad workspace access.
