migrate-to-detour

Pass

Audited by Gen Agent Trust Hub on Jun 30, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides legitimate developer assistance for migrating deep-linking SDKs. All procedures described (dashboard setup, app link configuration, and SDK implementation) are standard mobile development practices.
  • [CREDENTIALS_SAFE]: The skill adheres to security best practices by using placeholders for sensitive information and instructing the user to retrieve their own credentials from the vendor dashboard.
  • Evidence: Examples in SKILL.md and the platform-specific reference files use YOUR_API_KEY, YOUR_APP_ID, and YOUR_ORG instead of actual values.
  • Evidence: SKILL.md explicitly warns the user: "Always use placeholders in code... never ask the user for actual credentials."
  • [EXTERNAL_DOWNLOADS]: The skill references official SDK packages and documentation hosted on Software Mansion's infrastructure and GitHub repositories.
  • Evidence: references/android.md references the Maven repository at https://maven.swmansion.com and the SDK at com.swmansion.detour:detour-sdk.
  • Evidence: references/react-native.md references the NPM package @swmansion/react-native-detour.
  • Evidence: references/ios.md references the Swift package at https://github.com/software-mansion-labs/ios-detour.
  • [COMMAND_EXECUTION]: The skill includes shell commands for development and testing purposes, such as fetching fingerprints or enabling App Links on Android debug builds. These are well-documented standard developer workflows.
  • Evidence: SKILL.md and references/android.md suggest using ./gradlew signingReport and adb shell pm set-app-links-user-selection.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 30, 2026, 01:42 PM
Security Audit — agent-trust-hub — migrate-to-detour