mobile-storage-watermelondb
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns detected. The skill provides clear instructions on database management and offline-first synchronization without any signs of prompt injection, obfuscation, or unauthorized access.\n- [DATA_EXFILTRATION]: The skill uses
fetch()in its synchronization examples (examples/sync.md). These network operations target a placeholder domain (api.example.com) and are intended for legitimate data synchronization as per the skill's primary purpose. No sensitive local file access was observed in conjunction with these operations.\n- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface where the agent processes data fetched from external servers during synchronization.\n - Ingestion points: Remote data is fetched via
fetchinexamples/sync.mdand integrated into the application's local database.\n - Boundary markers: The skill does not use specific delimiters for raw API payloads but relies on schema-based mapping.\n
- Capability inventory: The skill utilizes
fetchfor network data transfer anddatabase.write/batchfor modifying the local filesystem-backed database.\n - Sanitization: The skill implements robust sanitization measures, including
Q.sanitizeLikeString()for search queries and customsanitizeTagsfunctions for complex data types.
Audit Metadata