deep-linking
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes standard command-line instructions for mobile developers, such as
adb shellfor Android testing,xcrun simctlfor iOS simulator testing, andkeytoolfor certificate management. These are documented for legitimate development and testing purposes. - [INDIRECT_PROMPT_INJECTION]: The skill provides templates for handling external URI data which acts as an untrusted input surface for the mobile application. 1. Ingestion points: URI data received via Android Intents and iOS URL contexts as shown in the Kotlin and Swift examples in
SKILL.md. 2. Boundary markers: No specific security boundaries or 'ignore' instructions are implemented in the provided logic. 3. Capability inventory: The skill demonstrates UI navigation capabilities based on parsed URI parameters. 4. Sanitization: The code examples show basic path segment filtering and safety checks (e.g., null-coalescing) to prevent common runtime crashes when processing external links.
Audit Metadata