The Agent Skills Directory

[COMMAND_EXECUTION]: The skill documentation includes various shell commands intended for mobile security testing. These involve the use of standard tools such as adb for Android interaction, apktool for decompilation, and dynamic instrumentation frameworks like frida and objection. These commands are scoped to interacting with connected mobile devices and local application artifacts.
[INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection because the agent is instructed to read and analyze data from external, untrusted sources such as mobile system logs (adb logcat), sandbox file contents, and decompiled source code. This is a standard risk for security analysis skills where the processed data is not under the agent's control.
Ingestion points: System logs, decompiled APK/IPA files, and pulled sandbox storage (shared_prefs, plist files) as described in SKILL.md.
Boundary markers: The skill does not explicitly define boundary markers or delimiters for the data being analyzed.
Capability inventory: The skill utilizes command execution capabilities (adb, frida, objection, apktool) to perform analysis.
Sanitization: No specific sanitization or filtering of the ingested log or file data is described.

mobile-insecure-storage