re-mobile-forensics
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from mobile device backups and application databases, which presents an indirect prompt injection surface inherent to the forensic analysis process.
- Ingestion points: Backup files (e.g., backup.ab, Manifest.db, Manifest.plist) and raw application databases (SQLite).
- Boundary markers: The instructions do not specify explicit delimiters or 'ignore' instructions to isolate the parsed data content from the agent's logic.
- Capability inventory: The skill utilizes shell commands (adb), database management (sqlite3), and file carving tools (foremost).
- Sanitization: No specific sanitization or schema validation for the mobile data content is defined in the workflow.
- [SAFE]: The skill demonstrates a professional forensic posture, prioritizing evidence integrity through flight mode isolation, strict adherence to authorization boundaries ('红线：仅授权设备'), and sha256 checksumming of all extraction products. Tools referenced are standard for the mobile forensics domain.
Audit Metadata