zepp-os-device-system

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill documents APIs in the @zos/device and @zos/user modules that provide access to device identifiers (Bluetooth, BLE, and Wi-Fi addresses) and personal user information (nickname, age, height, weight, gender, and region). These capabilities are standard features of the Zepp OS platform intended for application development and are managed by the platform's permission system (e.g., data:os.device.info, data:user.info).
  • [INDIRECT_PROMPT_INJECTION]: The skill documents the @zos/i18n module for loading localized strings from external .po files. This represents an attack surface for indirect prompt injection if an attacker provides malicious translation files.
  • Ingestion points: Localized strings are loaded from .po files via getText() (documented in references/i18n.md).
  • Boundary markers: The documentation does not specify the use of boundary markers or delimiters for these strings.
  • Capability inventory: The skill documents capabilities to interact with hardware (@zos/interaction), modify system display settings (@zos/display), and access user data (@zos/user).
  • Sanitization: No specific sanitization or validation of the content of internationalization files is described.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 10:55 AM
Security Audit — agent-trust-hub — zepp-os-device-system