ohos-app-dev
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted output from HarmonyOS device logs and documentation searches.\n
- Ingestion points: Accesses runtime data via
devecocli loganddevecocli docs searchwhich could contain malicious instructions or context pollution.\n - Boundary markers: Instructions explicitly mandate the use of
compact_command.pyanddevecocli_docs_bridge.pyto process and filter output before it is included in the LLM context, rather than passing raw output directly.\n - Capability inventory: The skill is capable of executing shell commands, building and deploying applications, and performing interactive UI actions (clicks, text input, swipes) using the
devecocliandhdctools.\n - Sanitization: Log output is filtered for specific error keywords using
rg, and documentation search results are processed to remove long fields and translate non-English snippets using local models.\n- [COMMAND_EXECUTION]: The skill utilizes command-line tools for application lifecycle management and environment verification.\n - Invokes the DevEco toolchain (
devecocli,hvigor,ohpm,hdc) for building, linting, and device interaction.\n - Uses PowerShell for system environment checks and identifying connected device serial numbers via
hdc list targets.\n- [EXTERNAL_DOWNLOADS]: The skill references external documentation hosted on the author's infrastructure for toolchain setup.\n - Provides a link to the
onirodeveloper/hackyeah2026-challengeGitHub repository for CLI installation troubleshooting instructions.
Audit Metadata