mobile-storage-watermelondb

Pass

Audited by Gen Agent Trust Hub on Jul 14, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: No malicious patterns detected. The skill provides clear instructions on database management and offline-first synchronization without any signs of prompt injection, obfuscation, or unauthorized access.\n- [DATA_EXFILTRATION]: The skill uses fetch() in its synchronization examples (examples/sync.md). These network operations target a placeholder domain (api.example.com) and are intended for legitimate data synchronization as per the skill's primary purpose. No sensitive local file access was observed in conjunction with these operations.\n- [PROMPT_INJECTION]: The skill demonstrates an indirect prompt injection surface where the agent processes data fetched from external servers during synchronization.\n
  • Ingestion points: Remote data is fetched via fetch in examples/sync.md and integrated into the application's local database.\n
  • Boundary markers: The skill does not use specific delimiters for raw API payloads but relies on schema-based mapping.\n
  • Capability inventory: The skill utilizes fetch for network data transfer and database.write/batch for modifying the local filesystem-backed database.\n
  • Sanitization: The skill implements robust sanitization measures, including Q.sanitizeLikeString() for search queries and custom sanitizeTags functions for complex data types.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 14, 2026, 09:24 AM
Security Audit — agent-trust-hub — mobile-storage-watermelondb