mobile-pentest
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a library of CLI commands using
adb,frida,objection, and various decompilers to audit mobile applications. These commands are standard for mobile security professionals and match the skill's stated intent. - [EXTERNAL_DOWNLOADS]: The documentation references industry-standard tools like Magisk, LSPosed, Jadx, and Apktool. No automated execution of remote scripts or unverified package installations were detected.
- [PROMPT_INJECTION]: The skill describes processes for ingesting data from untrusted third-party mobile applications (e.g., parsing manifests and source code). This constitutes an indirect prompt injection surface.
- Ingestion points: Reads and parses
AndroidManifest.xml, decompiled Java source code, and binary strings from APK/IPA files. - Boundary markers: None provided in the command examples.
- Capability inventory: Includes the ability to execute shell commands via
adb, inject JavaScript into processes via Frida, and read/write local files. - Sanitization: No specific sanitization or validation of the extracted application data is described.
Audit Metadata