core-bluetooth
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill documents standard implementations for Bluetooth Low Energy (BLE) communication using the Apple Core Bluetooth framework. The provided Swift code for managing central and peripheral roles, discovering services, and handling characteristics follows established iOS development best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for processing data received from external BLE peripherals, which represents an attack surface for untrusted data ingestion.
- Ingestion points: The peripheral(_:didUpdateValueFor:error:) method in SKILL.md and the BLEViewModel extension in ble-patterns.md read data directly from external Bluetooth characteristics.
- Boundary markers: The code examples do not implement specific boundary markers or instructions to the agent to ignore potentially malicious commands embedded in the BLE data packets.
- Capability inventory: The skill includes basic application logic for parsing sensor data (e.g., heart rate, battery level). It does not include tools for network exfiltration or dangerous system command execution.
- Sanitization: While the code includes basic data length validation and bitwise parsing, it lacks comprehensive sanitization for complex payloads received from untrusted hardware peripherals.
Audit Metadata