create-mobile-app

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [Indirect Prompt Injection Surface]: The skill processes user-provided descriptions and wizard answers to infer application features. While this is a standard design pattern for requirements discovery, it creates a surface where external input influences the agent's logic for planning app capabilities.
  • [Capability Ingestion Points]: As defined in references/requirements-discovery.md, the agent is instructed to scan user descriptions for specific keywords (e.g., 'log', 'photo', 'GPS') to determine which native modules or connectors to include.
  • [Boundary Markers and Sanitization]: The reference does not specify explicit delimiters or sanitization steps for the user-provided descriptions before they are parsed for signals, which is a consideration for multi-step agent workflows.
  • [External Package Integration]: The skill references standard development packages such as expo-location and vendor-provided modules like @microsoft/power-apps-native-bglocation. These are used as markers for architectural planning and are consistent with mobile application development practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 01:07 PM