scenario-unity-mobile
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/ut_mobile.pyandMobileBuild.csto execute essential mobile build tools includingkeytool,jarsigner,bundletool, andxcodebuild. These operations are consistent with the skill's primary function of building and signing mobile application bundles. - [DYNAMIC_EXECUTION]: Shell commands for the build pipeline are dynamically constructed in
scripts/ut_mobile.py. The use of list-based arguments forsubprocess.runmitigates standard shell injection risks. - [INDIRECT_PROMPT_INJECTION]: The
code_scanfunctionality inscripts/ut_mobile.pyreads and analyzes project C# source code using regular expressions. This processes untrusted data (Ingestion points: project C# files) without specific boundary markers. The skill possesses capabilities for subprocess execution (subprocess.runinscripts/ut_mobile.py). However, arguments are sanitized using list-based construction and the results are primarily used for reporting performance and compliance findings rather than driving autonomous agent actions, which limits the potential for exploitation.
Audit Metadata