lov-mobile-adapt
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill identifies mobile adaptation issues locally using a Python scanner. The analysis is performed entirely on the user's machine without any network access or external data transmission.
- [SAFE]: File access is restricted to standard web project extensions (HTML, CSS, JS, etc.) and explicitly skips sensitive directories like '.git' and 'node_modules' to ensure privacy and performance.
- [SAFE]: The execution workflow is well-defined and requires explicit user approval through the 'AskUserQuestion' tool before any file modifications are performed, maintaining human-in-the-loop control.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user project files which constitutes an indirect prompt injection surface. 1. Ingestion points: 'scripts/scan_mobile_issues.py' reads code from the user's project directory. 2. Boundary markers: The script output provides structured issue reports but does not use specific security delimiters for project code content. 3. Capability inventory: The skill can read/write files and execute the Python scanner script. 4. Sanitization: The tool performs regex-based scanning and does not sanitize the input content; however, the agent's instructions are narrowly scoped to specific CSS/HTML patterns, which mitigates the risk of following instructions found within scanned files. Given this is the primary purpose of the tool, the risk level is considered minimal.
Audit Metadata