homekit
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an unrecognized third-party domain (sosumi.ai) for all framework documentation and guides instead of official sources. This domain is not identified as a trusted organization or well-known service in the authoritative vendor lists.
- Evidence: Multiple links found in SKILL.md and references/matter-commissioning.md (e.g., https://sosumi.ai/documentation/homekit).
- [INDIRECT_PROMPT_INJECTION]: The use of untrusted external documentation links creates a surface for indirect prompt injection. If an agent fetches instructions from these URLs, it could be exposed to malicious content designed to influence its code generation or override safety protocols.
- Ingestion points: Documentation URLs in SKILL.md and references/matter-commissioning.md.
- Boundary markers: No instructions are provided to the agent to treat the content from these external links as untrusted.
- Capability inventory: The skill provides instructions for generating Swift code that interacts with smart-home systems (HomeKit) and handles Matter device commissioning.
- Sanitization: The skill contains no mechanisms for validating or sanitizing information retrieved from the external links.
Audit Metadata