build-mobile
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFEDATA_EXFILTRATIONEXTERNAL_DOWNLOADSPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DATA_EXFILTRATION]: The skill implements a telemetry system that reads configuration from
~/.superstack/config.json. If enabled, it transmits usage metadata including skill name, execution phase, event status, and platform architecture to a remote URL defined in the configuration viacurl. It also maintains a local log file at~/.superstack/telemetry.jsonl. This represents standard telemetry collection for a developer tool.\n- [EXTERNAL_DOWNLOADS]: The skill suggests cloning an external repository,https://github.com/sendaifun/solana-app-kit.git, for rapid prototyping. This repository is not owned by the skill author or a trusted vendor.\n- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as its workflow relies on state read from.superstack/build-context.md.\n - Ingestion points: Reads from
.superstack/build-context.mdinSKILL.md.\n - Boundary markers: None present; the skill treats the file content as authoritative instructions for stack selection.\n
- Capability inventory: Shell command execution (bash), package installation (npm), and repository cloning (git).\n
- Sanitization: No validation or escaping is performed on the data retrieved from the build context file.\n- [COMMAND_EXECUTION]: The skill's Preamble and Telemetry sections execute shell commands to manage environment setup, directory creation, and log usage data to the filesystem.
Audit Metadata