deep-linking

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes standard command-line instructions for mobile developers, such as adb shell for Android testing, xcrun simctl for iOS simulator testing, and keytool for certificate management. These are documented for legitimate development and testing purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides templates for handling external URI data which acts as an untrusted input surface for the mobile application. 1. Ingestion points: URI data received via Android Intents and iOS URL contexts as shown in the Kotlin and Swift examples in SKILL.md. 2. Boundary markers: No specific security boundaries or 'ignore' instructions are implemented in the provided logic. 3. Capability inventory: The skill demonstrates UI navigation capabilities based on parsed URI parameters. 4. Sanitization: The code examples show basic path segment filtering and safety checks (e.g., null-coalescing) to prevent common runtime crashes when processing external links.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:41 PM