port-rom

Warn

Audited by Gen Agent Trust Hub on Aug 1, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documentation in REFERENCE.md and instructions in AGENTS.md direct the agent to use sudo mount to inspect filesystem images. While sudo usage involves elevated privileges, it is described in the context of mounting loop devices for read-only inspection, a common task in ROM development. The skill includes a hard constraint requiring user confirmation for flashing or write operations.
  • [DATA_EXFILTRATION]: Documentation in references/nfc-oos-post-port.md suggests using adb logcat and dmesg to capture system logs. The output is redirected to local text files for debugging purposes, which is standard behavior for troubleshooting firmware issues.
  • [PROMPT_INJECTION]: The skill possesses a data ingestion surface through the processing of external Android partition images (system.img, vendor.img, etc.) as described in AGENTS.md and references/partition-strategy.md.
  • Ingestion points: ROM images mounted via sudo mount or erofsfuse for analysis.
  • Boundary markers: No specific delimiters or warnings to ignore instructions within the processed files (e.g., init.rc, build.prop) are provided.
  • Capability inventory: Access to tools including sudo, adb, rm, sed, and diff across various scripts and documentation.
  • Sanitization: No evidence of sanitization or filtering for the content extracted from the images was found.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 1, 2026, 11:49 PM