port-rom
Warn
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation in
REFERENCE.mdand instructions inAGENTS.mddirect the agent to usesudo mountto inspect filesystem images. Whilesudousage involves elevated privileges, it is described in the context of mounting loop devices for read-only inspection, a common task in ROM development. The skill includes a hard constraint requiring user confirmation for flashing or write operations. - [DATA_EXFILTRATION]: Documentation in
references/nfc-oos-post-port.mdsuggests usingadb logcatanddmesgto capture system logs. The output is redirected to local text files for debugging purposes, which is standard behavior for troubleshooting firmware issues. - [PROMPT_INJECTION]: The skill possesses a data ingestion surface through the processing of external Android partition images (
system.img,vendor.img, etc.) as described inAGENTS.mdandreferences/partition-strategy.md. - Ingestion points: ROM images mounted via
sudo mountorerofsfusefor analysis. - Boundary markers: No specific delimiters or warnings to ignore instructions within the processed files (e.g.,
init.rc,build.prop) are provided. - Capability inventory: Access to tools including
sudo,adb,rm,sed, anddiffacross various scripts and documentation. - Sanitization: No evidence of sanitization or filtering for the content extracted from the images was found.
Audit Metadata