mobilebuildmcp-packaging-resource-review
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute project-specific build and validation commands, such as
npm run build,npm run verify:portable, andnpx skill-check. These are standard operations within a development and packaging workflow. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and review external project files, which constitutes a potential attack surface for indirect prompt injection if those files contain malicious instructions.
- Ingestion points: Reads project files including
package.json, scripts, schemas, manifests, and skill definitions. - Boundary markers: None explicitly defined in the skill instructions.
- Capability inventory: The agent can execute shell commands (
npm,npx) and read/write files in the local environment. - Sanitization: No specific sanitization or validation of the content of the reviewed files is mentioned.
Audit Metadata