mobile-use-setup

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references external tools and templates for project setup. The scripts check-prerequisites.sh and create-project.sh contain informative messages suggesting the installation of the uv tool from the well-known developer service at https://astral.sh/uv/install.sh. Additionally, create-project.sh downloads an LLM configuration template from the vendor's repository at https://raw.githubusercontent.com/minitap-ai/mobile-use/main/llm-config.override.template.jsonc. These operations are consistent with the skill's stated purpose and target recognized sources.
  • [DYNAMIC_EXECUTION]: The create-project.sh script generates a starter Python file (main.py) from a static template. This is a standard initialization task and does not involve runtime execution of untrusted dynamic code.
  • [INDIRECT_PROMPT_INJECTION]: The skill includes a surface where user-supplied automation goals are interpolated into a generated script.
  • Ingestion points: scripts/create-project.sh defines a placeholder for automation goals within the main.py template.
  • Boundary markers: No specific delimiters or warnings for embedded instructions are present in the generated code.
  • Capability inventory: The resulting script uses the minitap-mobile-use SDK for mobile device automation.
  • Sanitization: No automated filtering is performed, as the goal is intended for manual user configuration.
  • [SAFE_PRACTICE]: The skill promotes secure credential management by instructing users to store API keys in a .env file and ensuring this file is added to .gitignore to prevent accidental data exposure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 08:39 AM