17-mobile-security
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements standard mobile security testing procedures and identifies potential vulnerabilities like hardcoded secrets and insecure manifest settings. It includes a custom Python script for static analysis and leverages reputable third-party tools such as Jadx and Frida. The documentation emphasizes authorized usage and evidence handling.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves analyzing untrusted mobile application artifacts (APKs/IPAs), which constitutes a potential surface for indirect prompt injection.
- Ingestion points: The
scripts/apk_analyzer.pytool and manual inspection steps read strings and source code from external files. - Boundary markers: The skill instructions include an explicit
Evidence contractrequiring the agent to treat file contents as untrusted data and not as instructions that override scope. - Capability inventory: The skill allows execution of shell commands for decompilation and dynamic instrumentation tools.
- Sanitization: The skill relies on natural language boundary instructions to separate untrusted artifact data from the agent's core operational logic.
Audit Metadata