Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward SwiftUI project generator with disclosed file output and QA handoff behavior, and no evidence of hidden execution, persistence, credential access, or exfiltration.
Before installing, expect this skill to write a multi-file Xcode project into dev-output/ and then pass the generated code to qa-skill. Use it in a workspace where that output path is acceptable, and check for existing files before generation.
The skill explicitly states it will create a complete Xcode project in dev-output/, but the user-facing description does not clearly warn that it will write a multi-file project to disk automatically. That can lead to unexpected filesystem modifications, overwriting existing contents, or user surprise in environments where file creation should be explicitly authorized.
The description mentions that the skill automatically triggers qa-skill after code generation, but it does not present this as a clear user warning or consent-requiring downstream action. Automatic chaining can expose generated artifacts to additional processing the user did not explicitly request, reducing transparency and control over agent behavior.
