dockkit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited dockkit (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 2 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 2 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Framework for integrating with motorized camera stands and gimbals that physically track subjects by rotating the iPhone. DockKit handles motor control, subject detection, and framing so camera apps get 360-degree pan and 90-degree tilt tracking with no additional code. Apps can override system tracking to supply custom observations, control motors directly, or adjust framing. iOS 17+, Swift 6.3.
Import DockKit:
import DockKitDockKit requires a physical DockKit-compatible accessory and a real device. The Simulator cannot connect to dock hardware.
DockKit itself requires no special entitlements or DockKit-specific Info.plist keys. Camera apps that use device cameras still need normal camera privacy handling, including NSCameraUsageDescription. The framework communicates with paired accessories automatically through the DockKit system daemon.
The app must use AVFoundation camera APIs. DockKit hooks into the camera pipeline to analyze frames for system tracking.
Use DockAccessoryManager.shared to observe dock connections:
import DockKit
func observeAccessories() async throws {
for await stateChange in try DockAccessoryManager.shared.accessoryStateChanges {
switch stateChange.state {
case .docked:
guard let accessory = stateChange.accessory else { continue }
// Accessory is connected and ready
configureAccessory(accessory)
case .undocked:
// iPhone removed from dock
handleUndocked()
@unknown default:
break
}
}
}accessoryStateChanges emits DockAccessory.StateChange values with state, accessory, and trackingButtonEnabled. Use accessory.identifier for the name, category, and UUID; hardware details are available via firmwareVersion and hardwareModel.
System tracking is DockKit's default mode. When enabled, the system analyzes camera frames through built-in ML inference, detects faces and bodies, and drives the motors to keep subjects in frame. Any app using AVFoundation camera APIs benefits automatically.
// Enable system tracking (default)
try await DockAccessoryManager.shared.setSystemTrackingEnabled(true)
// Disable system tracking for custom control
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)System tracking state does not persist across app termination, reboots, or background/foreground transitions. Set it explicitly whenever the app needs a specific value.
Allow users to select a specific subject by tapping:
// Select the subject at a unit point in video-frame coordinates
try await accessory.selectSubject(at: CGPoint(x: 0.5, y: 0.5))
// Select specific subjects by identifier
try await accessory.selectSubjects([subjectUUID])
// Clear selection (return to automatic selection)
try await accessory.selectSubjects([])Disable system tracking and provide your own observations when using custom ML models or the Vision framework.
Construct DockAccessory.Observation values from your inference output and pass them to the accessory at 10-30 fps:
import DockKit
import AVFoundation
func processFrame(
_ sampleBuffer: CMSampleBuffer,
accessory: DockAccessory,
activeDevice: AVCaptureDevice
) async throws {
let cameraInfo = DockAccessory.CameraInformation(
captureDevice: activeDevice.deviceType,
cameraPosition: activeDevice.position,
orientation: .corrected,
cameraIntrinsics: frameIntrinsics(from: sampleBuffer),
referenceDimensions: frameDimensions(from: sampleBuffer)
)
let detection = try await detector.detect(sampleBuffer)
let observationType: DockAccessory.Observation.ObservationType = switch detection.kind {
case .face: .humanFace
case .body: .humanBody
case .object: .object
}
let observation = DockAccessory.Observation(
identifier: detection.id,
type: observationType,
rect: detection.rect, // normalized, lower-left origin
faceYawAngle: detection.faceYawAngle
)
try await accessory.track([observation], cameraInformation: cameraInfo)
}When reviewing custom tracking, explicitly choose among the only supported ObservationType cases: .humanFace, .humanBody, and .object. Do not answer with only .humanFace when body or object detections are possible.
The rect uses normalized coordinates with a lower-left origin (same coordinate system as Vision framework -- no conversion needed).
DockAccessory.CameraInformation describes the active camera; do not hardcode placeholder device, intrinsics, or frame-size values. Set orientation to .corrected when coordinates are already relative to the bottom-left corner. In review answers, reject opaque optional cameraInfo placeholders and show construction from the active AVCaptureDevice plus the current CMSampleBuffer.
Track variants also accept [AVMetadataObject] instead of observations. Use the image: CVPixelBuffer overloads when DockKit should combine observations or metadata with the captured image buffer; the image argument is required in those overloads.
Control how the system frames tracked subjects:
try await accessory.setFramingMode(.automatic) // documented default
try await accessory.setFramingMode(.center) // explicit opt-in| Mode | Behavior |
|---|---|
.automatic | Documented default; system decides optimal framing |
.center | Explicit opt-in mode to keep subject centered |
.left | Frame subject in left third |
.right | Frame subject in right third |
Default system behavior often centers the primary subject, but .center is never the default-like mode; .automatic is. Use .left or .right when graphic overlays occupy part of the frame.
Constrain tracking to a specific area of the video frame:
// Normalized coordinates, origin at upper-left
let squareRegion = CGRect(x: 0.25, y: 0.0, width: 0.5, height: 1.0)
try await accessory.setRegionOfInterest(squareRegion)Use region of interest when cropping to a non-standard aspect ratio (e.g., square video for conferencing) so subjects stay within the visible area.
Disable system tracking before controlling motors directly.
Set continuous rotation speed in radians per second:
import Spatial
// Pan right at 0.2 rad/s, tilt down at 0.1 rad/s
let velocity = Vector3D(x: 0.1, y: 0.2, z: 0.0)
try await accessory.setAngularVelocity(velocity)
// Stop all motion
try await accessory.setAngularVelocity(Vector3D())Axes:
x -- pitch (tilt). Positive tilts down on iOS.y -- yaw (pan). Positive pans right.z -- roll (if supported by hardware).Move to a specific position over a duration:
let target = Vector3D(x: 0.0, y: 0.5, z: 0.0) // Yaw 0.5 rad
let progress = try accessory.setOrientation(
target,
duration: .seconds(2),
relative: false
)Also accepts Rotation3D for quaternion-based orientation. Set relative: true to move relative to the current position. The returned Progress object tracks completion.
Monitor the accessory's current position and velocity:
for await state in try accessory.motionStates {
let positions = state.angularPositions // Vector3D
let velocities = state.angularVelocities // Vector3D
let time = state.timestamp
if let error = state.error {
// Motor error occurred
}
}Restrict range of motion and maximum speed per axis:
let yawLimit = try DockAccessory.Limits.Limit(
positionRange: -1.0 ..< 1.0, // radians
maximumSpeed: 0.5 // rad/s
)
let limits = DockAccessory.Limits(yaw: yawLimit, pitch: nil, roll: nil)
try accessory.setLimits(limits)Built-in character animations that move the dock expressively:
// Disable system tracking before animating
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)
let progress = try await accessory.animate(motion: .kapow)
// Wait for completion
while !progress.isFinished && !progress.isCancelled {
try await Task.sleep(for: .milliseconds(100))
}
// Restore system tracking
try await DockAccessoryManager.shared.setSystemTrackingEnabled(true)| Animation | Effect |
|---|---|
.yes | Nodding motion |
.no | Shaking motion |
.wakeup | Startup-style motion |
.kapow | Dramatic pendulum swing |
Animations start from the accessory's current position and execute asynchronously. Always restore tracking state after completion. Keep animate(motion:) and setOrientation(_:duration:relative:) calls to no more than twice per second; higher call rates can throw .frameRateTooHigh.
iOS 18+ exposes ML-derived tracking signals through the throwing trackingStates async sequence. Each state has time and trackedSubjects (.person or .object); persons include identifier, rect, speakingConfidence, lookingAtCameraConfidence, and saliencyRank (lower rank is more salient).
if #available(iOS 18.0, *) {
for await state in try accessory.trackingStates {
var speaker: UUID?
var engaged: UUID?
var salient: (id: UUID, rank: Int)?
for subject in state.trackedSubjects {
switch subject {
case .person(let person):
let id = person.identifier, rect = person.rect
let speaking = person.speakingConfidence
let looking = person.lookingAtCameraConfidence
let rank = person.saliencyRank
updateSubjectOverlay(id: id, rect: rect)
if let speaking, speaking > 0.7 { speaker = id }
if let looking, looking > 0.7 { engaged = id }
if let rank, salient == nil || rank < salient!.rank { salient = (id, rank) }
case .object(let object):
let id = object.identifier, rect = object.rect
let rank = object.saliencyRank
updateSubjectOverlay(id: id, rect: rect)
if let rank, salient == nil || rank < salient!.rank { salient = (id, rank) }
}
}
if let id = speaker ?? engaged ?? salient?.id { try await accessory.selectSubjects([id]) }
}
}Use selectSubjects(_:) to lock tracking by UUID; pass [] to return to automatic selection. Use speakingConfidence for speakers, lookingAtCameraConfidence for engagement, rect for overlays, and lower saliencyRank values as fallback. In review answers, consume lookingAtCameraConfidence and rect in code, not just prose.
Physical buttons on the dock trigger events through the throwing accessoryEvents async sequence (iOS 17.4+):
if #available(iOS 17.4, *) {
for await event in try accessory.accessoryEvents {
switch event {
case .cameraShutter: break
case .cameraFlip: break
case .cameraZoom(factor: let factor): break
case .button(id: let id, pressed: let pressed): break
@unknown default: break
}
}
}Third-party apps receive these events and implement behavior through AVFoundation.
Monitor the dock's battery status through the throwing batteryStates async sequence (iOS 18+). A dock can report multiple batteries, each identified by name:
if #available(iOS 18.0, *) {
var batteryRows: [String: (Double, DockAccessory.BatteryChargeState, Bool)] = [:]
for await battery in try accessory.batteryStates {
batteryRows[battery.name] = (battery.batteryLevel, battery.chargeState, battery.lowBattery)
}
}// WRONG -- system tracking fights manual commands
try await accessory.setAngularVelocity(velocity)
// CORRECT -- disable system tracking first
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)
try await accessory.setAngularVelocity(velocity)// WRONG -- state may have reset after backgrounding
func applicationDidBecomeActive() {
// Assume custom tracking is still active
}
// CORRECT -- re-set tracking state on foreground
func applicationDidBecomeActive() {
Task {
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)
}
}// WRONG -- calling once per second is too slow
try await accessory.track(observations, cameraInformation: cameraInfo)
// (called at 1 fps)
// CORRECT -- call at 10-30 fps
// Hook into AVCaptureVideoDataOutputSampleBufferDelegate for per-frame callsDockKit can throw .frameRateTooHigh if animate(motion:) or setOrientation(_:duration:relative:) is called more than twice per second. Set a trajectory, observe its Progress, and avoid tight command loops.
// WRONG -- tracking stays disabled after animation
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)
let progress = try await accessory.animate(motion: .kapow)
// CORRECT -- restore tracking when animation completes
try await DockAccessoryManager.shared.setSystemTrackingEnabled(false)
let progress = try await accessory.animate(motion: .kapow)
while !progress.isFinished && !progress.isCancelled {
try await Task.sleep(for: .milliseconds(100))
}
try await DockAccessoryManager.shared.setSystemTrackingEnabled(true)DockKit requires a physical DockKit-compatible accessory. Guard initialization and provide fallback behavior when no accessory is available.
import DockKit present where neededaccessoryStateChanges to detect dock/undock events.docked and .undocked statesanimate and setOrientation commands limited to 2 calls per secondrect uses normalized coordinates (lower-left origin)AVCaptureDevice and current sample buffer.humanFace, .humanBody, and .object@unknown default handled in all switch statements over DockKit enumsaccessoryEvents guarded with #available(iOS 17.4, *)trackingStates and batteryStates guarded with #available(iOS 18.0, *)BatteryState.name for multi-battery docks~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.