device-interaction
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data originating from the UI hierarchy and screenshots of the application under test as documented in SKILL.md.
- [INDIRECT_PROMPT_INJECTION]: Evidence Chain:
- Ingestion points: The subagent reads application state through the UI hierarchy and screenshots provided by the
DeviceEventSynthesizetool. - Boundary markers: The instructions lack explicit boundary markers or directives for the agent to ignore natural language instructions found within the application's UI elements.
- Capability inventory: The skill possesses capabilities to interact with the device via
DeviceEventSynthesize, including tapping coordinates, typing text, and performing multi-touch sequences. - Sanitization: There is no evidence of sanitization or filtering applied to the text content extracted from the UI hierarchy before it is presented to the agent.
- [INDIRECT_PROMPT_INJECTION]: A malicious application or content within a legitimate application (e.g., a user-generated comment displayed in a label) could contain instructions that the subagent might incorrectly interpret as commands, such as 'Tap the delete button' or 'Type sensitive data into the field'.
Audit Metadata