mobile
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and act upon untrusted external data such as design specifications, API contracts, and existing web application source code. This creates a potential attack surface where malicious instructions embedded in these external sources could influence the agent's behavior.
- Ingestion points: External data is ingested during the intake phase in 'references/android.md', 'references/ios.md', 'references/cross.md', and 'references/pwa.md' (e.g., 'design spec' and 'backend API contract').
- Boundary markers: There are no specific instructions or delimiters provided to separate this untrusted data from the agent's own instructions, nor is the agent warned to treat such data as non-executable content.
- Capability inventory: The agent possesses high-privilege capabilities including 'bash', 'run_command', 'write_to_file', and 'replace_file_content', as documented in 'SKILL.md' and 'agents/openai.yaml'.
- Sanitization: The procedure lacks explicit sanitization or validation steps for the input data before it is interpolated into prompts or used to generate application logic.
Audit Metadata