offensive-mobile
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow for analyzing mobile application components which are external, potentially untrusted data sources. Ingestion points: Android manifest files, iOS plist files, source code, and binary artifacts processed during the discovery phase (SKILL.md). Boundary markers: The instructions do not specify the use of delimiters or 'ignore' instructions for the analyzed application content. Capability inventory: The skill references the use of npm test and external REA MCP tools for file system access and binary analysis. Sanitization: No sanitization or validation logic for the ingested mobile app data is described in the workflow.
- [SAFE]: The skill contains no executable code and its instructions are consistent with legitimate, authorized security assessment workflows.
Audit Metadata