mobile-visual-testing
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides templates for executing JavaScript code within the mobile application's Hermes runtime via the
mm cdp Runtime.evaluatecommand. This is used for advanced debugging tasks, including walking the React Native fiber tree, manipulating Redux state, and injecting network/console interceptors. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and processes mobile application UI data, such as accessibility trees and screen descriptions, which could potentially contain instructions from external app content. This data is used to inform the agent's interactions with the application.
- Ingestion points: UI state snapshots retrieved via
yarn mm describe-screenand network/console logs captured from the Hermes runtime. - Boundary markers: No explicit delimiters or instructions to ignore embedded instructions are provided in the skill documentation.
- Capability inventory: The skill allows for executing CLI commands (
mm) and arbitrary JavaScript within the application's React Native environment. - Sanitization: No sanitization or validation procedures are documented for the data ingested from the mobile application environment.
Audit Metadata