gomtm-e2e-verify
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill defines a legitimate workflow for system verification, focusing on three-platform connectivity (Cloud, Browser, Linux). The provided instructions are consistent with automated E2E testing goals.
- [COMMAND_EXECUTION]: The skill uses custom CLI tools (mtmai) and standard utilities (adb, git, tmux) to perform device management and testing operations. These commands are appropriate for the skill's stated purpose of verifying system integrity.
- [EXTERNAL_DOWNLOADS]: The instructions reference downloading APK files from an external repository's latest release. This is a standard and necessary step for verifying the functionality of the latest software build on physical devices.
- [SAFE]: Includes a dedicated section for the secure handling of login credentials, instructing the agent to identify the source of secrets without recording actual passwords or accounts, demonstrating good security awareness.
- [SAFE]: The skill identifies a data ingestion surface where the agent reads device status from a web dashboard. While this represents a point where external data enters the context, it is used exclusively for verification purposes within a controlled testing environment.
- Ingestion points: Web dashboard at ${GOMTMUI_PUBLIC_URL}/dash/devices.
- Boundary markers: Not explicitly mentioned for separating dashboard data from instructions.
- Capability inventory: Custom management commands via mtmai, code deployment via git, and device debugging via adb.
- Sanitization: No specific data sanitization is mentioned, which is common for internal verification tools.
Audit Metadata