These skills are plain Markdown loaded by AI coding agents. There is no runtime, no network code, and no data persistence in this repo. The relevant security surface is:
- Prompt-injection / jailbreak vectors in skill content that could steer an agent to ignore its host's safety rules.
- Insecure code guidance - example code that would introduce a real vulnerability if a developer copied it (e.g., disabling ATS, leaking credentials, unsafe entitlements, ignoring permission gates).
Please report privately via GitHub's Security Advisories ("Report a vulnerability" on the repo's Security tab). Do not open a public issue.
Include:
- The affected file/section.
- The issue and its impact.
- A suggested fix if you have one.
You can expect acknowledgement within a few business days and a fix or mitigation plan for confirmed issues.
- Bugs in the host AI agent (Claude, Copilot, Cursor, etc.) - report to the vendor.
- Bugs in Apple's frameworks - report to Apple.
- Requests to weaken a permission/security gate "for testing" or "for demos." These will be declined.