ohos-app-dev

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted output from HarmonyOS device logs and documentation searches.\n
  • Ingestion points: Accesses runtime data via devecocli log and devecocli docs search which could contain malicious instructions or context pollution.\n
  • Boundary markers: Instructions explicitly mandate the use of compact_command.py and devecocli_docs_bridge.py to process and filter output before it is included in the LLM context, rather than passing raw output directly.\n
  • Capability inventory: The skill is capable of executing shell commands, building and deploying applications, and performing interactive UI actions (clicks, text input, swipes) using the devecocli and hdc tools.\n
  • Sanitization: Log output is filtered for specific error keywords using rg, and documentation search results are processed to remove long fields and translate non-English snippets using local models.\n- [COMMAND_EXECUTION]: The skill utilizes command-line tools for application lifecycle management and environment verification.\n
  • Invokes the DevEco toolchain (devecocli, hvigor, ohpm, hdc) for building, linting, and device interaction.\n
  • Uses PowerShell for system environment checks and identifying connected device serial numbers via hdc list targets.\n- [EXTERNAL_DOWNLOADS]: The skill references external documentation hosted on the author's infrastructure for toolchain setup.\n
  • Provides a link to the onirodeveloper/hackyeah2026-challenge GitHub repository for CLI installation troubleshooting instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 09:48 AM