Agent skill · Audited from source
generators
skill · rshankras/claude-code-apple-skillsMIT licenceAudited 28 Oct 2026 · source 7fd70e317e5c
Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 7fd70e317e5c and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 13 findings, 4 critical or high. What it does: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings,…
Cite
Cite this page
ModelsAtlas. “generators (rshankras/claude-code-apple-skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/rshankras/generators
Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 4 critical or high findings, starting with “Prompt injection” in live-activity-generator/SKILL.md:211. Do not install it without reading them.
Trust audit
Audit 0.4.1 · source read 28 Oct 2026
BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.
What the source does
- FilesystemNone observedNo reads or writes in the source
- NetworkNone observedNo outbound calls in the source
- ShellNone observedNo commands run in the source
- DependenciesPinnedNothing floats
- SecretsNone foundNo keys in source
Five audit layers
| Layer | What we check | Result | Findings |
|---|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS | 0 |
L1 Static source | Secrets, path traversal, supply chain, hidden code | PASS | 0 |
L2 Instructions | Prompt injection, authority framing, hidden directives | FAIL | 13 |
L3 Inventory | The files and declarations match the source | PASS | 0 |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED why | 0 |
Gates applied: critical finding, no behavioural pass, undeclared transfer.
Findings (13)
CRITICALPrompt injectionprompt.transfer_instruction · live-activity-generator/SKILL.md:211
The generated `{Name}ActivityManager` automatically observes push token updates. Send the token to your server when it changes.- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injectionprompt.transfer_instruction · push-notifications/SKILL.md:212
// Send token to your server
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
HIGHPrompt injectionprompt.read_system · permission-priming/SKILL.md:210
// User taps "Take Photo" -> show camera priming -> then system prompt
- Why
- No further detail recorded for this rule.
- Fix
- —
HIGHPrompt injectionprompt.read_system · permission-priming/SKILL.md:244
- **Cannot re-show system prompt after denial.** Once the user denies a permission, iOS will never show the system dialog again. You must direct the user to Settings > Privacy to re-enable. Always han
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWPrompt injectionprompt.transfer_instruction · live-activity-generator/templates.md:420
/// Callback invoked when the push token changes. Send this token to your server.
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · live-activity-generator/templates.md:557
/// The push token can change during the activity lifetime; always send the latest to your server.
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · push-notifications/push-notification-patterns.md:82
// TODO: Implement server token upload
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.authority_framing · app-extensions/SKILL.md:250
By default keyboard extensions have no network access. The user must explicitly grant "Allow Full Access" in Settings. Without it, URLSession calls fail silently. Design your keyboard to work without
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · app-extensions/templates.md:405
/// The user must enable "Allow Full Access" in Settings for network
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · lapsed-user/templates.md:790
"Full access to all premium features",
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · subscription-lifecycle/patterns.md:75
- **User access:** Apple expects you to grant full access during this period
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.authority_framing · subscription-lifecycle/patterns.md:94
│ └── Full access, Apple shows payment UI
- Why
- No further detail recorded for this rule.
- Fix
- —
INFOPrompt injectionprompt.credential_read · app-extensions/templates.md:878
/// Load a string from the shared Keychain.
- Why
- asks the agent to read credentials
- Fix
- —
Audit 0.4.1 · source sha 7fd70e317e5c · 28 Oct 2026Report an issue or request a re-scan
Provenance
Who published it, and what the verdict is pinned to
- Publisherrshankras GitHub userOwner of the repository this skill is read from
- Source folderrshankras/claude-code-apple-skills/skills/generatorsThe exact folder we audited
- LicenceMITAs the repository states it
- Commit pinned for this verdict7fd70e317e5cA new audit runs when the source changes
- Repository statusNot archivedLast push 95 days ago
- Sandboxed runNot runSkills are read, not executed; layer L4 is skipped
What it tells the agent
Full source on GitHub ↗Its description: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings,…
---
name: generators
description: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings, persistence, error monitoring, CI/CD pipelines, localization, push notifications, deep linking, testing, accessibility, widgets, feature flags, app icons, image caching, pagination, HTTP caching, share cards, social export, subscription lifecycle, referral systems, watermarks, streak tracking, milestone celebrations, what's new screens, lapsed user re-engagement, usage insights, variable rewards, consent flows, account deletion, permission priming, force updates, state restoration, debug menus, offline queues, feedback forms, announcement banners, quick win sessions, Spotlight indexing, App Clips, screenshot automation, background processing, app extensions, data export, or SwiftUI preview sample data and variant matrices.
allowed-tools: [Read, Write, Edit, Glob, Grep, Bash, AskUserQuestion]
last_verified: 2026-07-16
review_by: 2027-06-22
os_version: iOS 27 / macOS 27
---
# Code Generators
Production-ready code generators for iOS and macOS apps. Unlike advisory skills (review, audit), these skills generate working code tailored to your project.
## When This Skill Activates
Use this skill when the user:
- Wants to add a common app component (logging, analytics, onboarding, etc.)
- Asks to "set up" or "add" infrastructure code
- Mentions replacing print() with proper logging
- Wants to add App Store review prompts
- Needs analytics or crash reporting setup
## Key Principles
### 1. Context-Aware Generation
Before generating code, skills will:
- Read existing project structure and patterns
- Detect deployment targets and Swift version
- Identify architecture patterns (MVVM, TCA, etc.)
- Check for existing implementations to avoid conflicts
### 2. Protocol-Based Architecture
Provider-dependent code uses protocols for easy swapping:
```swift
protocol AnalyticsService { ... }
class TelemetryDeckAnalytics: AnalyticsService { ... }
class FirebaseAnalytics: AnalyticsService { ... }
// Change provider by swapping ONE line
```
### 3. Platform Detection
Skills detect iOS vs macOS and App Store vs direct distribution to generate appropriate code.
## Available Generators
Read relevant module files based on the user's needs:
### logging-setup/
Replace print() statements with structured os.log/Logger.
- Audit existing print() usage
- Generate AppLogger infrastructure
- Migrate print → Logger with proper privacy levels
### analytics-setup/
Protocol-based analytics with swappable providers.
- TelemetryDeck, Firebase, Mixpanel support
- NoOp implementation for testing/privacy
- Easy provider switching
### onboarding-generator/
Value-moment-first onboarding — races a new user to the first felt experience of the app's promised outcome.
- Branches on ready-now vs. later, one decision per screen
- Root-swap presentation, phase-first gating, resume-safe hand-offs into existing features
- Local-notification implementation intentions for the "later" branch
- Value-moment reach-rate instrumentation (local-only, no analytics SDK required)
- Classic paged/stepped welcome carousel kept as an explicit fallback for explain-first apps
### review-prompt/
Smart App Store review prompts.
- Platform detection (skips for non-App Store macOS)
- Configurable trigger conditions
- Smart timing logic
- Debug override for testing
### networking-layer/
Protocol-based API client with async/await.
- Clean APIClient protocol for mocking/swapping
- Type-safe endpoint definitions
- Comprehensive error handling
- Environment-based configuration
### auth-flow/
Complete authentication flow.
- Sign in with Apple integration
- Biometric authentication (Face ID/Touch ID)
- Secure Keychain storage
- Credential state monitoring
### paywall-generator/
StoreKit 2 subscription paywall.
- Full StoreKit 2 implementation
- Product loading, purchasing, restoring
- Subscription status with Environment
- Beautiful paywall UI
### settings-screen/
Complete settings screen with modular sections.
- Centralized AppSettings with @AppStorage
- Appearance, Notifications, Account, About, Legal sections
- Cross-platform (iOS/macOS)
- Reusable row components
### persistence-setup/
SwiftData persistence with optional iCloud sync.
- SwiftData container configuration
- Repository pattern for testability
- Optional CloudKit/iCloud sync
- Sync status monitoring
- Migration support
### error-monitoring/
Protocol-based crash/error reporting.
- Sentry and Firebase Crashlytics support
- NoOp implementation for testing/privacy
- Breadcrumbs for debugging context
- User context (anonymized)
- Easy provider swapping
### ci-cd-setup/
CI/CD configuration for automated builds and deployment.
- GitHub Actions workflows (build, test, TestFlight, App Store)
- Xcode Cloud scripts and setup guide
- fastlane lanes for advanced automation
- Code signing and secrets management
- macOS notarization support
### localization-setup/
Internationalization (i18n) infrastructure for multi-language apps.
- String Catalogs (iOS 16+, recommended)
- Type-safe L10n enum for compile-time safety
- Pluralization and interpolation patterns
- RTL layout support
- SwiftUI preview helpers for testing locales
### push-notifications/
Push notification infrastructure with APNs setup.
- Registration and authorization flow
- UNUserNotificationCenterDelegate implementation
- Notification categories with action buttons
- Type-safe payload parsing
- Rich notifications and silent notifications
### deep-linking/
Deep linking with URL schemes, Universal Links, and App Intents.
- Custom URL scheme handling
- Universal Links with AASA file
- App Intents for Siri and Shortcuts
- Type-safe route definitions and navigation
- Spotlight indexing support
### test-generator/
Test templates for unit, integration, and UI tests.
- Swift Testing (modern, iOS 16+) Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.
Install
Pinned to the audited commit 7fd70e3
git clone https://github.com/rshankras/claude-code-apple-skills git -C claude-code-apple-skills checkout 7fd70e317e5c
The author documents no install command, so this uses the repository directly. Our verdict covers commit 7fd70e317e5c only.
Works in which agents?
What its own text says, not a test
| Agent | Status | More |
|---|---|---|
| Cursor | Mentioned in its text, not tested | Skills for Cursor · About Cursor |
Audit history
Every audit, every source change
- ✕BLOCK D 69 / 100
first audit · source
7fd70e317e5c
Similar skills
rshankras/claude-code-apple-skills
Legal document generation and compliance guidance for indie Apple developers. Covers privacy policies, terms of service, EULAs, GDPR/CCPA/DPDP compliance, and Apple App Store legal requirements. Use when user needs…
rshankras/claude-code-apple-skills
Growth skills for indie Apple developers — user acquisition, analytics interpretation, press/media outreach, community building, and indie business operations. Also covers the stage-by-stage store-growth audit and the…
rshankras/claude-code-apple-skills
Design skills for Apple platform UI — Liquid Glass, animations, game feel (haptics, sound, celebrations), UI prototyping, UX writing, SF Symbols, and typography. Use when implementing design language features, adding…
rshankras/claude-code-apple-skills
Core ML, Create ML, Vision framework, Natural Language framework, on-device ML integration. Use when user wants image classification, text analysis, object detection, sound classification, model optimization, or custom…
rshankras/claude-code-apple-skills
Apple Intelligence skills for on-device AI features including Foundation Models, Visual Intelligence, App Intents, and intelligent assistants. Use when implementing AI-powered features.
rshankras/claude-code-apple-skills
Generate compelling App Store descriptions that convert browsers into users. Use when writing initial descriptions, improving existing copy, or drafting promotional text and What's New for a major update.
Questions about generators
What does the generators skill do?
Is generators safe to install?
What can generators access on my machine?
Which assistants does generators work with?
How current is this page?
Sources
- github.com/rshankras/claude-code-apple-skills/tree/main/skills/g — the audited source at commit 7fd70e317e5c and every finding aboveObserved · 28 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What does the generators skill do?
- Is generators safe to install?
- What can generators access on my machine?