mobile-design-review
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill accesses local project files including
package.json,app.json, theme files, and documentation likeMOBILE-DESIGN.md. This access is restricted to the local development environment and is necessary for the skill's stated purpose of auditing app design. - [COMMAND_EXECUTION]: In its optional 'Fix mode', the skill is authorized to perform file edits and execute
git commitcommands to apply design improvements. These operations are gated by explicit user opt-in and include a 'risk governor' to limit the scope of changes. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the project being audited.
- Ingestion points: Reads project configuration files (
package.json,app.json), local design documents, and processes user-provided screenshots or live simulator views. - Boundary markers: No explicit delimiters or instructions to ignore embedded prompts in processed files are defined in the skill instructions.
- Capability inventory: In 'fix mode', the skill can modify application files and execute shell commands for git commits.
- Sanitization: The instructions do not specify sanitization or validation routines for the data ingested from the project files or screenshots.
- Note: While the attack surface exists, this is common for development tools and is mitigated by the 'report-only' default state and explicit constraints on allowed modifications.
Audit Metadata