mobile-emulator-test
Fail
Audited by Gen Agent Trust Hub on Jul 24, 2026
Risk Level: HIGHCREDENTIALS_UNSAFECOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill (Phase 0c) directs the agent to search for and read sensitive environment files like ".env" and ".env.local" to extract service credentials including "SUPABASE_URL" and "SENTRY_DSN". It further instructs the agent (Phase 2.5d) to query a database for magic-link authentication tokens ("token_hash") via the Supabase MCP, granting the agent direct access to live authentication secrets.
- [COMMAND_EXECUTION]: The skill executes high-risk shell commands, including modifying Android Virtual Device (AVD) configuration files ("config.ini") within the user's home directory and performing aggressive process termination using "kill -9" and "taskkill" on processes identified by port (Phase 1.5b).
- [DATA_EXFILTRATION]: The skill collects and analyzes broad system telemetry, including full "logcat" dumps and UI tree dumps (Phase 1d, 2b), which may inadvertently capture and expose personally identifiable information (PII) or sensitive internal application state.
- [PROMPT_INJECTION]: The skill exhibits a significant surface for indirect prompt injection due to its ingestion of untrusted data from external sources.
- Ingestion points: Reads "logcat" output, "uiautomator dump" XML, and "screencap" images from the device under test.
- Boundary markers: None; the agent is instructed to process raw telemetry directly without delimiters or safety warnings.
- Capability inventory: "adb shell" (command execution), "execute_sql" (database access), and "curl" (network operations).
- Sanitization: None; the agent processes raw external inputs to make critical logic decisions regarding build quality and test success.
Recommendations
- AI detected serious security threats
Audit Metadata