e2e-testing-mobile
Pass
Audited by Gen Agent Trust Hub on May 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing the Maestro CLI using a shell script from
https://get.maestro.mobile.dev. This is the official installation source for the Maestro testing framework, a well-known service in the mobile development ecosystem. - [COMMAND_EXECUTION]: The skill directs the agent to execute several local CLI commands (
maestro,eas,jq,xcrun,adb) to verify the environment, check for running simulators, and execute test flows. These operations are within the expected scope of a mobile testing utility. - [EXTERNAL_DOWNLOADS]: The skill references the installation of official Node.js packages, including
eas-cliand the@mobile-dev-inc/maestro-mcptool, which are standard utilities for Expo and Maestro automation. - [PROMPT_INJECTION]: The skill employs a 'spec-first' workflow that ingests Markdown files from the
specs/directory to generate Maestro YAML test flows. This represents a surface for indirect prompt injection if the source data is untrusted. However, the skill incorporates a 'Phase 0' gate and explicitly mentions user review of specifications as a primary step.
Audit Metadata