1k-cold-start-ssr
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines a unified log taxonomy and provides shell-based analysis commands that ingest content from application log files (app-latest.log). This creates a vulnerability to indirect prompt injection if malicious data or instructions are embedded within the log entries.
- Ingestion points: The documentation instructs the agent or user to process logs located in simulator cache paths and Android app internal storage (files/logs/app-latest.log) using shell commands.
- Boundary markers: No delimiters or explicit instructions to ignore embedded content are provided in the analysis scripts.
- Capability inventory: The skill utilizes shell command execution (find, grep, sed, awk, xargs) for processing the log data.
- Sanitization: There is no evidence of validation or sanitization for the log content before it is parsed via regular expressions.
Audit Metadata