create-mobile-app
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [Indirect Prompt Injection Surface]: The skill processes user-provided descriptions and wizard answers to infer application features. While this is a standard design pattern for requirements discovery, it creates a surface where external input influences the agent's logic for planning app capabilities.
- [Capability Ingestion Points]: As defined in
references/requirements-discovery.md, the agent is instructed to scan user descriptions for specific keywords (e.g., 'log', 'photo', 'GPS') to determine which native modules or connectors to include. - [Boundary Markers and Sanitization]: The reference does not specify explicit delimiters or sanitization steps for the user-provided descriptions before they are parsed for signals, which is a consideration for multi-step agent workflows.
- [External Package Integration]: The skill references standard development packages such as
expo-locationand vendor-provided modules like@microsoft/power-apps-native-bglocation. These are used as markers for architectural planning and are consistent with mobile application development practices.
Audit Metadata