Mobile Check
Pass
Audited by Gen Agent Trust Hub on Apr 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run local shell commands like
npm run devornext devto start a development server if one is not already running on common ports. - [REMOTE_CODE_EXECUTION]: Custom JavaScript audit scripts are executed within the browser context via
browser_evaluateto inspect the DOM for layout and accessibility issues. - [EXTERNAL_DOWNLOADS]: The agent navigates to and retrieves content from external or local URLs provided in the command arguments to perform mobile verification.
- [PROMPT_INJECTION]: The skill processes untrusted data from web pages and local project files, creating a surface for indirect prompt injection.
- Ingestion points: External URLs and local filesystem paths used to discover routes and audit content.
- Boundary markers: No specific delimiters are used to separate untrusted site content from the agent's internal logic.
- Capability inventory: Includes shell command execution, filesystem traversal, and browser script execution.
- Sanitization: The skill does not define methods for sanitizing data retrieved from the live DOM before it is processed by the agent.
Audit Metadata