mobile-use-setup
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external tools and templates for project setup. The scripts
check-prerequisites.shandcreate-project.shcontain informative messages suggesting the installation of theuvtool from the well-known developer service athttps://astral.sh/uv/install.sh. Additionally,create-project.shdownloads an LLM configuration template from the vendor's repository athttps://raw.githubusercontent.com/minitap-ai/mobile-use/main/llm-config.override.template.jsonc. These operations are consistent with the skill's stated purpose and target recognized sources. - [DYNAMIC_EXECUTION]: The
create-project.shscript generates a starter Python file (main.py) from a static template. This is a standard initialization task and does not involve runtime execution of untrusted dynamic code. - [INDIRECT_PROMPT_INJECTION]: The skill includes a surface where user-supplied automation goals are interpolated into a generated script.
- Ingestion points:
scripts/create-project.shdefines a placeholder for automation goals within themain.pytemplate. - Boundary markers: No specific delimiters or warnings for embedded instructions are present in the generated code.
- Capability inventory: The resulting script uses the
minitap-mobile-useSDK for mobile device automation. - Sanitization: No automated filtering is performed, as the goal is intended for manual user configuration.
- [SAFE_PRACTICE]: The skill promotes secure credential management by instructing users to store API keys in a
.envfile and ensuring this file is added to.gitignoreto prevent accidental data exposure.
Audit Metadata