ionic
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill addresses the processing of untrusted external data via deep links and push notifications.
- Ingestion points: The references/native-features.md file identifies the appUrlOpen and pushNotificationActionPerformed listeners as points where external payloads enter the application.
- Boundary markers: The instructions advise developers to isolate the router-relative path from the scheme and host components of the URL.
- Capability inventory: The skill utilizes Router.navigateByUrl to trigger navigation based on the processed external data.
- Sanitization: The guidance explicitly requires stripping domain information and implementing fallback routes for unmatched paths to mitigate risks such as open redirection.
- [EXTERNAL_DOWNLOADS]: The skill recommends integrating Capacitor plugins from the Capawesome and Capacitor Community organizations.
- Evidence: The SKILL.md file defines a sourcing priority that includes the @capawesome/capacitor-* and @capacitor-community/* package scopes.
- Context: These sources are recognized as established community contributors for extending Capacitor's native capabilities beyond the core library.
Audit Metadata