flutter-mobile-debugging
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documents the use of several command-line tools to manage mobile environments.
- Utilizes
adbfor Android-specific tasks such as installing APKs, starting activities via intents, and clearing or capturing log buffers. - Utilizes
xcrun simctlfor iOS simulator management, including app installation, launching, and termination. - Includes
pkillto force-terminate hungxcdeviceandflutter_toolsprocesses as part of a troubleshooting workflow. - [PROMPT_INJECTION]: The skill exposes an indirect prompt injection surface by processing untrusted data from external tools.
- Ingestion points: The agent is instructed to read and analyze output from
adb logcatand UI metadata frommcp mobile_list_elements_on_screeninSKILL.md. - Boundary markers: There are no instructions in
SKILL.mdto use delimiters or ignore potentially malicious instructions embedded in the device logs or UI element labels. - Capability inventory: The skill allows the agent to execute shell commands (
adb shell) and simulate user input (mcp mobile_click_on_screen_at_coordinates,mcp mobile_type_keys) based on its interpretation of the ingested data inSKILL.md. - Sanitization:
SKILL.mddoes not describe any validation or sanitization of the strings retrieved from the mobile device before they are processed by the agent.
Audit Metadata