zepp-os-device-system
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill documents APIs in the
@zos/deviceand@zos/usermodules that provide access to device identifiers (Bluetooth, BLE, and Wi-Fi addresses) and personal user information (nickname, age, height, weight, gender, and region). These capabilities are standard features of the Zepp OS platform intended for application development and are managed by the platform's permission system (e.g.,data:os.device.info,data:user.info). - [INDIRECT_PROMPT_INJECTION]: The skill documents the
@zos/i18nmodule for loading localized strings from external.pofiles. This represents an attack surface for indirect prompt injection if an attacker provides malicious translation files. - Ingestion points: Localized strings are loaded from
.pofiles viagetText()(documented inreferences/i18n.md). - Boundary markers: The documentation does not specify the use of boundary markers or delimiters for these strings.
- Capability inventory: The skill documents capabilities to interact with hardware (
@zos/interaction), modify system display settings (@zos/display), and access user data (@zos/user). - Sanitization: No specific sanitization or validation of the content of internationalization files is described.
Audit Metadata