skills/lynricsy/hyperskills/harmonyos/Gen Agent Trust Hub

harmonyos

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documents a 'vision-driven device automation' workflow in references/build-sign-verify.md and SKILL.md that leverages natural language instructions to perform device interactions, creating a potential vector for indirect prompt injection.
  • Ingestion points: Natural language descriptions of interactions are processed by automation tools as described in references/build-sign-verify.md.
  • Boundary markers: No specific delimiters or safety warnings for the natural language automation loop are provided.
  • Capability inventory: The automation tools possess capabilities to execute hdc shell commands and perform UI events like clicks and text input via the uitest system utility.
  • Sanitization: The documentation does not specify validation or sanitization of the natural language instructions before they are processed by the automation model.
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to use npx -y @midscene/harmony@1 within the references/build-sign-verify.md file, which involves downloading and executing code from the NPM registry to facilitate device automation.
  • [COMMAND_EXECUTION]: The skill involves the execution of various command-line tools such as hvigorw, ohpm, hdc, and uitest for building applications, managing dependencies, and verifying behavior on connected HarmonyOS devices.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 03:14 PM
Security Audit — agent-trust-hub — harmonyos