mobile-security
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational content and implementation templates for platform-standard security controls, including iOS Keychain, Android EncryptedSharedPreferences, and certificate pinning logic. All code snippets are pedagogical and follow security best practices.
- [SAFE]: Documentation references well-known and trusted security industry tools such as MobSF, Burp Suite, Frida, and Snyk for auditing and testing purposes. These references are documented neutrally and align with the skill's primary purpose.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its design of generating security artifacts based on user-provided platform and requirement context.
- Ingestion points: User-provided inputs regarding platform (iOS, Android, etc.) and security requirements in the trigger mechanism (SKILL.md).
- Boundary markers: Absent; the instructions do not define specific delimiters or instructions to ignore embedded commands in the provided input context.
- Capability inventory: The agent is instructed to generate implementation snippets, threat model summaries, and verification steps based on this untrusted input.
- Sanitization: Absent; there are no instructions to sanitize or validate the user-provided context before it is interpolated into the output document.
Audit Metadata