flutter-mobile-debugging

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents the use of several command-line tools to manage mobile environments.
  • Utilizes adb for Android-specific tasks such as installing APKs, starting activities via intents, and clearing or capturing log buffers.
  • Utilizes xcrun simctl for iOS simulator management, including app installation, launching, and termination.
  • Includes pkill to force-terminate hung xcdevice and flutter_tools processes as part of a troubleshooting workflow.
  • [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted data from external tools.
  • Ingestion points: The agent is instructed to read and analyze output from adb logcat and UI metadata from mcp mobile_list_elements_on_screen in SKILL.md.
  • Boundary markers: There are no instructions in SKILL.md to use delimiters or ignore potentially malicious instructions embedded in the device logs or UI element labels.
  • Capability inventory: The skill allows the agent to execute shell commands (adb shell) and simulate user input (mcp mobile_click_on_screen_at_coordinates, mcp mobile_type_keys) based on its interpretation of the ingested data in SKILL.md.
  • Sanitization: SKILL.md does not describe any validation or sanitization of the strings retrieved from the mobile device before they are processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 06:02 AM
Security Audit — agent-trust-hub — flutter-mobile-debugging