CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/hig-technologies/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/hig-technologies/SKILL.md· markdown

27### Payments and Commerce

294. **Transparent and frictionless.** Standard Apple Pay button styles. Never ask for card de

… (108 chars elided on L29)

31### Health and Fitness

Occurrences

1 occurrence · at L29

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha2565084aa178cfd9d97…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/hig-technologies/SKILL.md · 1 file

skills/hig-technologies/SKILL.md5.3 KB · Markdown

name: hig-technologies

description: Check for .claude/apple-design-context.md before asking questions. Use existing context and only ask for information not already covered.

category: Document Processing

source: antigravity

tags: [api, claude, ai, workflow, design, document, image, security, rag, cro]

url: https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/hig-technologies

Apple HIG: Technologies

Check for .claude/apple-design-context.md before asking questions. Use existing context and only ask for information not already covered.

Key Principles

General

Apple technologies extend app capabilities through system integration. Each technology has established user-facing patterns; deviating creates confusion and erodes trust.

Privacy and user control are paramount. Especially for health, payment, and identity technologies. Request only needed data, explain why, respect choices.

Siri and Voice

Natural, predictable, recoverable. Clear conversational intent phrases that complete quickly and confirm results. Support App Shortcuts for proactive suggestions. Handle errors with clear fallbacks.

Payments and Commerce

Transparent and frictionless. Standard Apple Pay button styles. Never ask for card details when Apple Pay is available. Clearly describe what the user is buying, the price, and whether it's one-time or subscription.

Health and Fitness

Health data is deeply personal. Explain the health benefit before requesting access. CareKit tasks should be encouraging. ResearchKit consent flows must be thorough, readable, and respect autonomy.

Smart Home

Simple and reliable. Immediate response when controlling devices. Clear device state. Graceful handling of connectivity issues.

Augmented Reality

Genuine value, not gimmicks. Use AR when spatial context improves understanding. Guide setup (surface, lighting, space). Provide clear exit back to standard interaction.

Machine Learning and Generative AI

Enhance without surprising. Smart suggestions, image recognition, text prediction. Clearly attribute AI-generated content. Controls to edit, regenerate, or dismiss. Let users correct mistakes.

Identity and Authentication

Sign in with Apple as top option. Standard button styles. Respect email hiding preference. ID Verifier: guided flows, don't store sensitive data beyond what verification requires.

Cloud and Data

Invisible and reliable sync. Data appears on all devices without manual intervention. Handle conflicts gracefully. Never lose data.

Shared Experiences

Real-time participation. SharePlay: support multiple participants, show presence, handle latency. AirPlay: appropriate Now Playing metadata.

Automotive

Driver safety first. Minimize interaction complexity, large touch targets, no distracting content. Only permitted app types: audio, messaging, EV charging, navigation, parking, quick food ordering.

Accessibility

Baseline requirement. Every element has a meaningful VoiceOver label, trait, and action. Support Dynamic Type, Switch Control, and other assistive technologies. Test entirely with VoiceOver enabled.

Reference Index

Reference	Topic	Key content
siri.md	Siri	Intents, shortcuts, voice interaction, App Shortcuts
apple-pay.md	Apple Pay	Payment buttons, checkout flow, security
tap-to-pay-on-iphone.md	Tap to Pay	Merchant flows, contactless payment
in-app-purchase.md	In-app purchase	Subscriptions, one-time purchases, transparency
healthkit.md	HealthKit	Health data access, privacy, permissions
carekit.md	CareKit	Care plans, tasks, health management
researchkit.md	ResearchKit	Studies, informed consent, data collection
homekit.md	HomeKit	Smart home control, device state, scenes
augmented-reality.md	ARKit	Spatial context, surface detection, setup
machine-learning.md	Core ML	Predictions, smart features, confidence handling
generative-ai.md	Generative AI	Attribution, editing, responsible AI, uncertainty
icloud.md	iCloud	CloudKit, cross-device sync, conflict resolution
sign-in-with-apple.md	Sign in with Apple	Authentication, privacy, button styles
id-verifier.md	ID Verifier	Identity verification, document scanning
shareplay.md	SharePlay	Shared experiences, participant presence
airplay.md	AirPlay	Media streaming, Now Playing, wireless display
carplay.md	CarPlay	Driver safety, permitted app types, large targets
game-center.md	Game Center	Achievements, leaderboards, multiplayer
voiceover.md	VoiceOver	Screen reader, labels, traits, accessibility
wallet.md	Wallet	Passes, tickets, loyalt

hig-technologies— agent skill

Is hig-technologies safe to install?

Apple HIG: Technologies

Key Principles

General

Siri and Voice

Payments and Commerce

Health and Fitness

Smart Home

Augmented Reality

Machine Learning and Generative AI

Identity and Authentication

Cloud and Data

Shared Experiences

Automotive

Accessibility

Reference Index

Audit the pieces. Scan the whole. Decide.