mobile-device-matrix-toolkit
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external configuration and result files, creating an attack surface where malicious data could influence agent or CI behavior. 1. Ingestion points: .matrix/devices.yaml (processed in Step 2) and JUnit XML result files (processed in Step 4). 2. Boundary markers: No markers or explicit warnings are used to delimit data from instructions in the YAML configuration or XML reports. 3. Capability inventory: The skill generates shell command arguments in gen-matrix.py and parses XML structures in aggregate-matrix.py. 4. Sanitization: The gen-matrix.py script replaces spaces with hyphens in device names but fails to escape other shell metacharacters like backticks, dollar signs, or semicolons, allowing for potential command injection. The aggregate-matrix.py script uses xml.etree.ElementTree.parse(), which is vulnerable to XML External Entity (XXE) attacks if processing untrusted reports.
- [COMMAND_EXECUTION]: The GitHub Actions workflow in Step 2 executes shell commands using variables (matrix.target.name) derived directly from the user-controlled .matrix/devices.yaml file. This lack of escaping for shell metacharacters creates a command injection vulnerability.
Audit Metadata