技能 limrun-xcode
📦

limrun-xcode

內容修訂 r1 嚴重 ⚙️ 外部命令🌐 網路存取🔑 環境變數

Build Apple Apps on Remote Xcode

Local Apple builds require macOS and Xcode infrastructure. This skill sends projects to Limrun for remote builds, simulator installation, signing, previews, and App Store uploads.

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "limrun-xcode" from https://skillstore.io/skills/limrun-inc-limrun-xcode.md and its manifest at https://skillstore.io/api/skills/limrun-inc-limrun-xcode/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/limrun-inc-limrun-xcode.md 已簽名 manifest GET /api/skills/limrun-inc-limrun-xcode/manifest 已簽名 lockfile GET /api/skills/limrun-inc-limrun-xcode/lockfile

測試它

正在使用「limrun-xcode」。 Build the default project in Debug and install it on the attached simulator.

預期結果:

  • The remote Debug build completed for scheme MyApp.
  • The application was installed and relaunched on the attached simulator.

正在使用「limrun-xcode」。 Create a signed release IPA and keep the artifact for fourteen days.

預期結果:

  • Release IPA signing passed the server verification.
  • The artifact upload completed with a fourteen-day retention period.

正在使用「limrun-xcode」。 Upload the approved release to App Store Connect and wait for its status.

預期結果:

  • App Store Connect accepted the upload and is processing build 142.
  • No retry was started because delivery succeeded.

安全審計

嚴重
v1 • 2026/8/21 開啟版本化報告

Most static alerts are false positives caused by Markdown backticks, command fences, identifiers, and a documented URL. Confirmed risks involve soliciting an API key and transmitting Apple signing certificates and passwords to a remote build service. Semantic review also identified unpinned global package installation, source-code upload, and privileged App Store credential transfer.

1
已掃描檔案
333
分析行數
1
複核項目
0
已忽略的誤報

已確認的安全問題 (6)

嚴重
SKILL.md:126-135SKILL.md:202-223
Privileged Apple Credentials Sent to Remote Service
The cloud workflow supplies an App Store Connect private key to a third-party service with authority to sign and upload application releases.
The cited commands pass the private key path and identifiers to remote signing and App Store upload operations.
高
SKILL.md:156
Certificate/key files
--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \
The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.
高
SKILL.md:174
Certificate/key files
--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \
The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.
高
SKILL.md:210
Certificate/key files
--certificate-p12 dist.p12 --certificate-password "$P12_PASSWORD" \
The remote build command supplies a signing certificate and its password to Limrun. Process-argument exposure or remote-service compromise could disclose signing credentials.
高
SKILL.md:10-15
Project Source Uploaded to Third-Party Infrastructure
The skill directs the agent to sync project sources to Limrun infrastructure and continue remote execution until the application works.
Lines 10 through 15 explicitly state that sources are synced to remote Xcode and built there.
高
SKILL.md:23
Unpinned Global Package Installation
The skill directs installation of the latest globally published lim npm package without version or integrity controls.
Line 23 gives a global npm installation command with no version pin, checksum, or package provenance check.
能力複核項目 (1)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
SKILL.md:311
Generic API/secret keys
`LIM_API_KEY` is wrong; ask the user to run `lim login` or provide a key.
The instruction tells the agent to ask the user to provide LIM_API_KEY after an authentication error. This can cause disclosure of an API credential in chat.

風險因素

⚙️ 外部命令 (50)
SKILL.md:3 SKILL.md:11 SKILL.md:18 SKILL.md:19 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:27 SKILL.md:29-32 SKILL.md:32-36 SKILL.md:36-38 SKILL.md:38-40 SKILL.md:40-45 SKILL.md:45 SKILL.md:48-50 SKILL.md:50-52 SKILL.md:52 SKILL.md:53-54 SKILL.md:54-56 SKILL.md:56-58 SKILL.md:58-60 SKILL.md:60 SKILL.md:65-67 SKILL.md:67-72 SKILL.md:72-74 SKILL.md:74-78 SKILL.md:78 SKILL.md:80-82 SKILL.md:82-84 SKILL.md:84-86 SKILL.md:86-87 SKILL.md:87-88 SKILL.md:88-93 SKILL.md:93-95 SKILL.md:95-98 SKILL.md:98-100 SKILL.md:100 SKILL.md:106-109 SKILL.md:109-112 SKILL.md:112-114 SKILL.md:114-120 SKILL.md:120-122 SKILL.md:122-128 SKILL.md:128-130 SKILL.md:130-136 SKILL.md:136-140 SKILL.md:140-141 SKILL.md:141-142 SKILL.md:142-144 SKILL.md:144-145
🌐 網路存取 (1)
SKILL.md:296
🔑 環境變數 (2)
SKILL.md:24 SKILL.md:311
審計單位: codex
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/limrun-inc-limrun-xcode/security.svg)](https://skillstore.io/skills/limrun-inc-limrun-xcode?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/limrun-inc-limrun-xcode?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/limrun-inc-limrun-xcode/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/limrun-inc-limrun-xcode.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

limrun-inc. (2026). limrun-xcode security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1

BibTeX 引用

@techreport{limrun-inc-limrun-inc-limrun-xcode-2026, author = {limrun-inc}, title = {limrun-xcode security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "limrun-xcode security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "limrun-inc" date-released: "2026-08-21" url: "https://skillstore.io/skills/limrun-inc-limrun-xcode/audits/1" identifiers: - type: other value: "skillstore:limrun-inc-limrun-xcode:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 低
55
架構
85
可維護性
87
內容
65
社群
83
規範符合度

你可以打造什麼

Build iOS Without Local Xcode

Compile and install an Apple application from Linux, Windows, macOS, a virtual machine, or a container.

Automate Remote Apple Builds

Run repeatable Debug or Release builds for projects, workspaces, XcodeGen, React Native, and Expo repositories.

Prepare and Deliver Signed IPAs

Create signed device artifacts and upload approved releases to storage or App Store Connect.

試試這些提示

Build a Basic Xcode Project 
Build the Apple project in [project path] with Limrun. Use the default scheme and report the build result and artifact location.
Build a Selected Workspace 
Build [workspace] with scheme [scheme] and configuration [Debug or Release]. Attach a remote simulator only when installation or interaction is required.
Create a Signed Device IPA 
Create a signed IPA for [bundle identifier] using [cloud or manual] signing. Ask before transmitting credentials, then report the secure download location.
Deliver an App Store Build 
Build [project] for App Store Connect, increment the build number, and sign with least-privileged credentials. Upload after my explicit confirmation and report processing status.

最佳實務

  • Confirm the source path, scheme, workspace, configuration, and target before starting a remote build.
  • Use interactive login and least-privileged, short-lived signing credentials whenever possible.
  • Request explicit approval before source upload, credential transmission, artifact publication, or App Store delivery.

避免

  • Do not paste API keys, certificate passwords, private keys, or signed access URLs into conversation history.
  • Do not use this skill for Bazel workspaces or local simulator automation.
  • Do not retry an accepted App Store upload while Apple is still processing it.

常見問題

Do I need macOS or local Xcode?
No. The project is synchronized to Limrun and built on remote Xcode infrastructure.
Does this skill support Bazel workspaces?
No. Use the limrun-xcode-bazel skill for Bazel-based Apple projects.
Can it interact with the running simulator?
It can install and relaunch builds. Use limrun-ios-simulator for taps, typing, screenshots, recordings, and element inspection.
Which project types are supported?
It supports Xcode projects, workspaces, XcodeGen specifications, React Native native builds, and Expo native builds.
How are signed IPA files created?
The skill supports Apple cloud signing or manual signing with a certificate and matching provisioning profiles.
Can it upload directly to App Store Connect?
Yes. It can sign and upload an approved build using an App Store Connect API key.

開發者詳細資訊

作者

limrun-inc

授權

MIT

Skillstore 修訂

r1

版本提示

作者未聲明版本。

儲存庫

https://github.com/limrun-inc/skills/tree/e29a129cea3d311d2bd348eef1aadcd1b20397d5/skills/limrun-xcode

引用

4ec79c4a51e6b1df1b440d2b6ae810d3f433a601

維護新鮮度

2026/8/22

使用量

0 次下載 · 0 次瀏覽

檔案結構

📄 SKILL.md