Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only RealityKit/visionOS developer skill with purpose-aligned AR, sensor, sync, and file-saving examples, but installers should still treat privacy-sensitive AR features carefully.
Installers can treat this as a benign developer reference skill. When using its examples in an app, review ARKit camera/sensor/body-tracking permissions, disclose any body or environment tracking to users, limit what synchronized entities share with other participants, and confirm file destinations before saving generated assets.
The documentation encourages use of ARKit body tracking but omits any explicit user-facing privacy warning that body and movement data are sensitive biometric/behavioral signals. In a developer skill, this can lead downstream implementations to collect or process body-pose data without clear disclosure, consent flows, or privacy-safe handling, increasing privacy and compliance risk.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Requires ARKit body tracking support (hardware and software)
- Works with `ARBodyTrackingConfiguration` in ARKit
- Available on supported devices (typically newer iPhones and iPads)
- Requires appropriate Info.plist permissions
- Body tracking data comes from ARKit, not RealityKit directly
- Check `ARBodyTrackingConfiguration.isSupported` before use
- Platform availability may vary - check documentation for your target OS version
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Requires ARKit body tracking support (hardware and software)
- Works with `ARBodyTrackingConfiguration` in ARKit
- Available on supported devices (typically newer iPhones and iPads)
- Requires appropriate Info.plist permissions
- Body tracking data comes from ARKit, not RealityKit directly
- Check `ARBodyTrackingConfiguration.isSupported` before use
- Platform availability may vary - check documentation for your target OS version
The documentation states that entity state is automatically replicated across devices and sessions, but it does not warn that transforms, component values, and other synchronized state may contain sensitive or user-derived information. In a developer skill focused on implementing shared RealityKit experiences, this omission can lead users to enable synchronization by default without considering privacy boundaries, data minimization, or consent.
The example instructs developers to enable collaboration networking and immediately add synchronized entities, but it omits any warning that this activates multi-participant data sharing over a networked session. In practice, developers may copy this pattern into production code without adding access controls, participant trust checks, or disclosure to users that shared state will propagate to other devices.
This markdown file includes a real-world example that initializes and runs an ARKit world-tracking session to query the device anchor, which affects privacy-sensitive sensor access. The surrounding documentation describes how to implement it but does not warn users that the example uses device/head tracking or may require camera/sensor permissions.
This markdown file documents AR anchoring to hands, head, face, images, objects, and scene understanding, which can involve camera- and sensor-derived tracking of the user's environment or body. While the file is instructional, it does not include any user-facing warning about privacy implications or environmental/body tracking behavior.
This markdown file includes an example that writes an entity with animations to a file via robot.write(to: fileURL), which affects user/system data on disk. The surrounding description does not include any warning or caution about overwriting files, choosing a safe destination, or the persistence side effect.
No suspicious patterns detected.