mobile-testing

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill includes an explicit plaintext password in a CLI example (input-text --text "secret") and instructs capturing request headers/bodies, which forces the LLM to handle or emit secret values verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Required runtime workflow reads Android app UI/accessibility snapshots and logcat output produced during the test (e.g., a11y take-ui-snapshot and o11y log-follow), and these contents can include outsider-authored free text entered/controlled through the app flow or echoed into the UI/logs.