run-cloud-ios-simulator
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill integrates with the run.cloud mobile simulation service. All external tools (runcloud CLI) and library dependencies (@run-cloud/sdk, @runcloud/ui) are consistent with the skill's functionality and the author's primary use case.
- [CREDENTIALS_UNSAFE]: The instructions correctly advise against hardcoding sensitive information, instead recommending standard security practices such as using environment variables (e.g., RUN_CLOUD_API_KEY and RUN_CLOUD_API_TOKEN) for authentication.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from simulator logs and screenshots (e.g., via runcloud ios logs or runcloud android screenshot). While these represent a vulnerability surface for indirect prompt injection, they are necessary for the primary purpose of debugging and testing mobile applications. Evidence chain:
- Ingestion points: Application logs (logs command) and session screenshots (screenshot command) as described in SKILL.md.
- Boundary markers: None specified in the provided instructions for processing this external data.
- Capability inventory: File reading (create --install), network tunneling (tunnel), and simulated user input (tap, type-text) are available via the CLI and SDK as documented in SKILL.md.
- Sanitization: No explicit log or image sanitization is described in the skill content.
Audit Metadata