📦

limrun-xcode

Name: limrun-xcode
Author: limrun-inc

Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети🔑 Переменные окружения

Build Apple Apps on Remote Xcode

Local Apple builds require macOS and Xcode infrastructure. This skill sends projects to Limrun for remote builds, simulator installation, signing, previews, and App Store uploads.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Не устанавливайте этот Skill автоматически.

Каноническая политика требует проверки оператором перед любым действием по установке.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "limrun-xcode" from https://skillstore.io/skills/limrun-inc-limrun-xcode.md and its manifest at https://skillstore.io/api/skills/limrun-inc-limrun-xcode/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/limrun-inc-limrun-xcode.md Подписанный manifest GET /api/skills/limrun-inc-limrun-xcode/manifest Подписанный lockfile GET /api/skills/limrun-inc-limrun-xcode/lockfile

Протестировать

Использование «limrun-xcode». Build the default project in Debug and install it on the attached simulator.

Ожидаемый результат:

The remote Debug build completed for scheme MyApp.
The application was installed and relaunched on the attached simulator.

Использование «limrun-xcode». Create a signed release IPA and keep the artifact for fourteen days.

Ожидаемый результат:

Release IPA signing passed the server verification.
The artifact upload completed with a fourteen-day retention period.

Использование «limrun-xcode». Upload the approved release to App Store Connect and wait for its status.

Ожидаемый результат:

App Store Connect accepted the upload and is processing build 142.
No retry was started because delivery succeeded.

Аудит безопасности

Критично

v1 • 21.08.2026 Открыть версионный отчет

Most static alerts are false positives caused by Markdown backticks, command fences, identifiers, and a documented URL. Confirmed risks involve soliciting an API key and transmitting Apple signing certificates and passwords to a remote build service. Semantic review also identified unpinned global package installation, source-code upload, and privileged App Store credential transfer.

Просканировано файлов

333

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (6)

Критично

SKILL.md:126-135 SKILL.md:202-223

Privileged Apple Credentials Sent to Remote Service

The cloud workflow supplies an App Store Connect private key to a third-party service with authority to sign and upload application releases.

The cited commands pass the private key path and identifiers to remote signing and App Store upload operations.

Высокий

SKILL.md:156

Certificate/key files

--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \

The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.

Высокий

SKILL.md:174

Certificate/key files

--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \

The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.

Высокий

SKILL.md:210

Certificate/key files

--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \

The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.

Высокий

SKILL.md:10-15

Project Source Uploaded to Third-Party Infrastructure

The skill directs the agent to sync project sources to Limrun infrastructure and continue remote execution until the application works.

Lines 10 through 15 explicitly state that sources are synced to remote Xcode and built there.

Высокий

SKILL.md:23

Unpinned Global Package Installation

The skill directs installation of the latest globally published lim npm package without version or integrity controls.

Line 23 gives a global npm installation command with no version pin, checksum, or package provenance check.

Пункты проверки возможностей (1)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Высокий

SKILL.md:311

Generic API/secret keys

`LIM_API_KEY` is wrong; ask the user to run `lim login` or provide a key.

The instruction tells the agent to ask the user to provide LIM_API_KEY after an authentication error. This can cause disclosure of an API credential in chat.

Факторы риска

⚙️ Внешние команды (50)

🌐 Доступ к сети (1)

SKILL.md:296

🔑 Переменные окружения (2)

SKILL.md:24 SKILL.md:311

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/limrun-inc-limrun-xcode/security.svg)](https://skillstore.io/skills/limrun-inc-limrun-xcode?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/limrun-inc-limrun-xcode?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/limrun-inc-limrun-xcode/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/limrun-inc-limrun-xcode.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

limrun-inc. (2026). limrun-xcode security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1

Цитата BibTeX

@techreport{limrun-inc-limrun-inc-limrun-xcode-2026,
  author = {limrun-inc},
  title = {limrun-xcode security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "limrun-xcode security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "limrun-inc"
date-released: "2026-08-21"
url: "https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1"
identifiers:
  - type: other
    value: "skillstore:limrun-inc-limrun-xcode:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Низкий

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Build iOS Without Local Xcode

Compile and install an Apple application from Linux, Windows, macOS, a virtual machine, or a container.

Automate Remote Apple Builds

Run repeatable Debug or Release builds for projects, workspaces, XcodeGen, React Native, and Expo repositories.

Prepare and Deliver Signed IPAs

Create signed device artifacts and upload approved releases to storage or App Store Connect.

Попробуйте эти промпты

Build a Basic Xcode Project

Build the Apple project in [project path] with Limrun. Use the default scheme and report the build result and artifact location.

Build a Selected Workspace

Build [workspace] with scheme [scheme] and configuration [Debug or Release]. Attach a remote simulator only when installation or interaction is required.

Create a Signed Device IPA

Create a signed IPA for [bundle identifier] using [cloud or manual] signing. Ask before transmitting credentials, then report the secure download location.

Deliver an App Store Build

Build [project] for App Store Connect, increment the build number, and sign with least-privileged credentials. Upload after my explicit confirmation and report processing status.

Лучшие практики

Confirm the source path, scheme, workspace, configuration, and target before starting a remote build.
Use interactive login and least-privileged, short-lived signing credentials whenever possible.
Request explicit approval before source upload, credential transmission, artifact publication, or App Store delivery.

Избегать

Do not paste API keys, certificate passwords, private keys, or signed access URLs into conversation history.
Do not use this skill for Bazel workspaces or local simulator automation.
Do not retry an accepted App Store upload while Apple is still processing it.

Часто задаваемые вопросы

Do I need macOS or local Xcode?

No. The project is synchronized to Limrun and built on remote Xcode infrastructure.

Does this skill support Bazel workspaces?

No. Use the limrun-xcode-bazel skill for Bazel-based Apple projects.

Can it interact with the running simulator?

It can install and relaunch builds. Use limrun-ios-simulator for taps, typing, screenshots, recordings, and element inspection.

Which project types are supported?

It supports Xcode projects, workspaces, XcodeGen specifications, React Native native builds, and Expo native builds.

How are signed IPA files created?

The skill supports Apple cloud signing or manual signing with a certificate and matching provisioning profiles.

Can it upload directly to App Store Connect?

Yes. It can sign and upload an approved build using an App Store Connect API key.

Сведения для разработчиков

Автор

limrun-inc

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/limrun-inc/skills/tree/e29a129cea3d311d2bd348eef1aadcd1b20397d5/skills/limrun-xcode

Ссылка

4ec79c4a51e6b1df1b440d2b6ae810d3f433a601

Актуальность поддержки

22.08.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md