skills/mukul975/anthropic-cybersecurity-skills/performing-android-app-static-analysis-with-mobsf/Gen Agent Trust Hub
performing-android-app-static-analysis-with-mobsf
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted Android application files (APK/AAB) for security scanning, which presents a surface for indirect prompt injection if the files contain malicious metadata.
- Ingestion points: Android application packages provided to
agent.pyandprocess.pythrough the--apkparameter, or uploaded via the documentedcurlcommands inSKILL.md. - Boundary markers: The scripts do not utilize specific delimiters or instructions to prevent the agent from interpreting content within the application's metadata or code as instructions during the reporting phase.
- Capability inventory: The automation scripts are capable of making network requests (HTTP POST) to a local or remote MobSF server and writing analysis results to the local filesystem.
- Sanitization: The scripts pass data from the MobSF API (which is derived from the APK) directly into the summary output and report files without additional sanitization of potentially malicious strings.
Audit Metadata