Agent skill · Audited from source

generators

skill · rshankras/claude-code-apple-skillsMIT licenceAudited 28 Oct 2026 · source 7fd70e317e5c

★ 836pushed 95 days ago
✕BLOCKGrade D · 69/100 · 13 findings · 7fd70e3
836repo stars · whole rshankras/claude-code-apple-skills

Is it safe? No — BLOCK, grade D (69/100). We read this skill's source at commit 7fd70e317e5c and found no filesystem, network or shell access and no hard-coded secrets. The audit raised 13 findings, 4 critical or high. What it does: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings,…

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
Cite

Cite this page

ModelsAtlas. “generators (rshankras/claude-code-apple-skills)”. Retrieved 28 Oct 2026. https://modelsatlas.com/skills/rshankras/generators

Blocked. The page stays public so you can check this skill if someone recommended it to you. The audit found 4 critical or high findings, starting with “Prompt injection” in live-activity-generator/SKILL.md:211. Do not install it without reading them.

Trust audit

Audit 0.4.1 · source read 28 Oct 2026

Trust score69/100✕BLOCK D
2 critical2 high0 medium3 low6 info

BLOCK means the audit found something that could harm you or your machine. Grade D is shared by 642 of 14,816 audited skills.

What the source does

  • FilesystemNone observedNo reads or writes in the source
  • NetworkNone observedNo outbound calls in the source
  • ShellNone observedNo commands run in the source
  • DependenciesPinnedNothing floats
  • SecretsNone foundNo keys in source

Five audit layers

LayerWhat we checkResultFindings
L0 ProvenanceRepo owner, licence, archive status, activityPASS0
L1 Static sourceSecrets, path traversal, supply chain, hidden codePASS0
L2 InstructionsPrompt injection, authority framing, hidden directivesFAIL13
L3 InventoryThe files and declarations match the sourcePASS0
L4 SandboxRun in isolation and watch behaviourSKIPPED why0

Gates applied: critical finding, no behavioural pass, undeclared transfer.

Findings (13)

CRITICALPrompt injectionprompt.transfer_instruction · live-activity-generator/SKILL.md:211
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
The generated `{Name}ActivityManager` automatically observes push token updates. Send the token to your server when it changes.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injectionprompt.transfer_instruction · push-notifications/SKILL.md:212
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// Send token to your server
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
HIGHPrompt injectionprompt.read_system · permission-priming/SKILL.md:210
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// User taps "Take Photo" -> show camera priming -> then system prompt
Why
No further detail recorded for this rule.
Fix
—
HIGHPrompt injectionprompt.read_system · permission-priming/SKILL.md:244
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **Cannot re-show system prompt after denial.** Once the user denies a permission, iOS will never show the system dialog again. You must direct the user to Settings > Privacy to re-enable. Always han
Why
No further detail recorded for this rule.
Fix
—
LOWPrompt injectionprompt.transfer_instruction · live-activity-generator/templates.md:420
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// Callback invoked when the push token changes. Send this token to your server.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · live-activity-generator/templates.md:557
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// The push token can change during the activity lifetime; always send the latest to your server.
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
LOWPrompt injectionprompt.transfer_instruction · push-notifications/push-notification-patterns.md:82
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// TODO: Implement server token upload
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine
INFOPrompt injectionprompt.authority_framing · app-extensions/SKILL.md:250
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
By default keyboard extensions have no network access. The user must explicitly grant "Allow Full Access" in Settings. Without it, URLSession calls fail silently. Design your keyboard to work without
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · app-extensions/templates.md:405
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// The user must enable "Allow Full Access" in Settings for network
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · lapsed-user/templates.md:790
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
"Full access to all premium features",
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · subscription-lifecycle/patterns.md:75
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **User access:** Apple expects you to grant full access during this period
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.authority_framing · subscription-lifecycle/patterns.md:94
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
│   └── Full access, Apple shows payment UI
Why
No further detail recorded for this rule.
Fix
—
INFOPrompt injectionprompt.credential_read · app-extensions/templates.md:878
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
/// Load a string from the shared Keychain.
Why
asks the agent to read credentials
Fix
—

Audit 0.4.1 · source sha 7fd70e317e5c · 28 Oct 2026Report an issue or request a re-scan

Provenance

Who published it, and what the verdict is pinned to

  • Publisherrshankras GitHub userOwner of the repository this skill is read from
  • Source folderrshankras/claude-code-apple-skills/skills/generatorsThe exact folder we audited
  • LicenceMITAs the repository states it
  • Commit pinned for this verdict7fd70e317e5cA new audit runs when the source changes
  • Repository statusNot archivedLast push 95 days ago
  • Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

What it tells the agent

Full source on GitHub ↗

Its description: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings,…

---
name: generators
description: Code generator skills that produce production-ready Swift code for common app components. Use when user wants to add logging, analytics, onboarding, review prompts, networking, authentication, paywalls, settings, persistence, error monitoring, CI/CD pipelines, localization, push notifications, deep linking, testing, accessibility, widgets, feature flags, app icons, image caching, pagination, HTTP caching, share cards, social export, subscription lifecycle, referral systems, watermarks, streak tracking, milestone celebrations, what's new screens, lapsed user re-engagement, usage insights, variable rewards, consent flows, account deletion, permission priming, force updates, state restoration, debug menus, offline queues, feedback forms, announcement banners, quick win sessions, Spotlight indexing, App Clips, screenshot automation, background processing, app extensions, data export, or SwiftUI preview sample data and variant matrices.
allowed-tools: [Read, Write, Edit, Glob, Grep, Bash, AskUserQuestion]
last_verified: 2026-07-16
review_by: 2027-06-22
os_version: iOS 27 / macOS 27
---

# Code Generators

Production-ready code generators for iOS and macOS apps. Unlike advisory skills (review, audit), these skills generate working code tailored to your project.

## When This Skill Activates

Use this skill when the user:
- Wants to add a common app component (logging, analytics, onboarding, etc.)
- Asks to "set up" or "add" infrastructure code
- Mentions replacing print() with proper logging
- Wants to add App Store review prompts
- Needs analytics or crash reporting setup

## Key Principles

### 1. Context-Aware Generation
Before generating code, skills will:
- Read existing project structure and patterns
- Detect deployment targets and Swift version
- Identify architecture patterns (MVVM, TCA, etc.)
- Check for existing implementations to avoid conflicts

### 2. Protocol-Based Architecture
Provider-dependent code uses protocols for easy swapping:
```swift
protocol AnalyticsService { ... }
class TelemetryDeckAnalytics: AnalyticsService { ... }
class FirebaseAnalytics: AnalyticsService { ... }
// Change provider by swapping ONE line
```

### 3. Platform Detection
Skills detect iOS vs macOS and App Store vs direct distribution to generate appropriate code.

## Available Generators

Read relevant module files based on the user's needs:

### logging-setup/
Replace print() statements with structured os.log/Logger.
- Audit existing print() usage
- Generate AppLogger infrastructure
- Migrate print → Logger with proper privacy levels

### analytics-setup/
Protocol-based analytics with swappable providers.
- TelemetryDeck, Firebase, Mixpanel support
- NoOp implementation for testing/privacy
- Easy provider switching

### onboarding-generator/
Value-moment-first onboarding — races a new user to the first felt experience of the app's promised outcome.
- Branches on ready-now vs. later, one decision per screen
- Root-swap presentation, phase-first gating, resume-safe hand-offs into existing features
- Local-notification implementation intentions for the "later" branch
- Value-moment reach-rate instrumentation (local-only, no analytics SDK required)
- Classic paged/stepped welcome carousel kept as an explicit fallback for explain-first apps

### review-prompt/
Smart App Store review prompts.
- Platform detection (skips for non-App Store macOS)
- Configurable trigger conditions
- Smart timing logic
- Debug override for testing

### networking-layer/
Protocol-based API client with async/await.
- Clean APIClient protocol for mocking/swapping
- Type-safe endpoint definitions
- Comprehensive error handling
- Environment-based configuration

### auth-flow/
Complete authentication flow.
- Sign in with Apple integration
- Biometric authentication (Face ID/Touch ID)
- Secure Keychain storage
- Credential state monitoring

### paywall-generator/
StoreKit 2 subscription paywall.
- Full StoreKit 2 implementation
- Product loading, purchasing, restoring
- Subscription status with Environment
- Beautiful paywall UI

### settings-screen/
Complete settings screen with modular sections.
- Centralized AppSettings with @AppStorage
- Appearance, Notifications, Account, About, Legal sections
- Cross-platform (iOS/macOS)
- Reusable row components

### persistence-setup/
SwiftData persistence with optional iCloud sync.
- SwiftData container configuration
- Repository pattern for testability
- Optional CloudKit/iCloud sync
- Sync status monitoring
- Migration support

### error-monitoring/
Protocol-based crash/error reporting.
- Sentry and Firebase Crashlytics support
- NoOp implementation for testing/privacy
- Breadcrumbs for debugging context
- User context (anonymized)
- Easy provider swapping

### ci-cd-setup/
CI/CD configuration for automated builds and deployment.
- GitHub Actions workflows (build, test, TestFlight, App Store)
- Xcode Cloud scripts and setup guide
- fastlane lanes for advanced automation
- Code signing and secrets management
- macOS notarization support

### localization-setup/
Internationalization (i18n) infrastructure for multi-language apps.
- String Catalogs (iOS 16+, recommended)
- Type-safe L10n enum for compile-time safety
- Pluralization and interpolation patterns
- RTL layout support
- SwiftUI preview helpers for testing locales

### push-notifications/
Push notification infrastructure with APNs setup.
- Registration and authorization flow
- UNUserNotificationCenterDelegate implementation
- Notification categories with action buttons
- Type-safe payload parsing
- Rich notifications and silent notifications

### deep-linking/
Deep linking with URL schemes, Universal Links, and App Intents.
- Custom URL scheme handling
- Universal Links with AASA file
- App Intents for Siri and Shortcuts
- Type-safe route definitions and navigation
- Spotlight indexing support

### test-generator/
Test templates for unit, integration, and UI tests.
- Swift Testing (modern, iOS 16+) 

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

Install

Pinned to the audited commit 7fd70e3

git clone https://github.com/rshankras/claude-code-apple-skills
git -C claude-code-apple-skills checkout 7fd70e317e5c

The author documents no install command, so this uses the repository directly. Our verdict covers commit 7fd70e317e5c only.

Works in which agents?

What its own text says, not a test

AgentStatusMore
CursorMentioned in its text, not testedSkills for Cursor · About Cursor
“Mentioned” means the skill’s text names the agent. We have not run it there.

Audit history

Every audit, every source change

  1. ✕BLOCK D 69 / 100

    first audit · source 7fd70e317e5c

Similar skills

legal✓SAFE

rshankras/claude-code-apple-skills

Legal document generation and compliance guidance for indie Apple developers. Covers privacy policies, terms of service, EULAs, GDPR/CCPA/DPDP compliance, and Apple App Store legal requirements. Use when user needs…

★ 838Grade B
growth✓SAFE

rshankras/claude-code-apple-skills

Growth skills for indie Apple developers — user acquisition, analytics interpretation, press/media outreach, community building, and indie business operations. Also covers the stage-by-stage store-growth audit and the…

★ 837Grade B
design✓SAFE

rshankras/claude-code-apple-skills

Design skills for Apple platform UI — Liquid Glass, animations, game feel (haptics, sound, celebrations), UI prototyping, UX writing, SF Symbols, and typography. Use when implementing design language features, adding…

★ 836Grade B
core-ml✓SAFE

rshankras/claude-code-apple-skills

Core ML, Create ML, Vision framework, Natural Language framework, on-device ML integration. Use when user wants image classification, text analysis, object detection, sound classification, model optimization, or custom…

★ 834Grade B
apple-intelligence✓SAFE

rshankras/claude-code-apple-skills

Apple Intelligence skills for on-device AI features including Foundation Models, Visual Intelligence, App Intents, and intelligent assistants. Use when implementing AI-powered features.

★ 830Grade B
App Description Writer✓SAFE

rshankras/claude-code-apple-skills

Generate compelling App Store descriptions that convert browsers into users. Use when writing initial descriptions, improving existing copy, or drafting promotional text and What's New for a major update.

★ 810Grade B

Questions about generators

What does the generators skill do?
Claude Code skills for Apple platform development (iOS, macOS, iPadOS) — product validation, code generation, App Store optimization, and more
Is generators safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can generators access on my machine?
The audit observed no filesystem, network or shell use at all in its source.
Which assistants does generators work with?
Its documentation mentions cursor. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (7fd70e317e5c), read on 2026-10-28. The repository is watched, and a new audit runs when it changes — this is the first audit.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.