mobile-platform-native-capabilities-integrate
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill provides instructions for accessing sensitive user data, including contacts, calendar events, geographic location, and biometric authentication status. These operations are performed using the official
lightning/mobileCapabilitiesmodule and are gated by the standard mobile operating system permission flows. This access is consistent with the skill's primary purpose of providing mobile-native functionality. - [INDIRECT_PROMPT_INJECTION]: The skill enables an agent to process data from untrusted external sources, such as barcodes, scanned document text, and NFC tag payloads.
- Ingestion points: Data enters the environment through
BarcodeScanner.scan(),DocumentScanner.scan(), andNfcService.read(). - Boundary markers: The documentation does not specify the use of delimiters or 'ignore' instructions for the data read from these sensors.
- Capability inventory: The skill allows for writing data back to the device (e.g.,
ContactsService.putContact,CalendarService.addEvent) and initiating payments viaPaymentsService.collectPayment. - Sanitization: The instructions do not explicitly detail sanitization of the sensor-derived content before it is interpolated into subsequent actions.
Audit Metadata