sensorkit
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill references framework documentation using an unofficial third-party domain (sosumi.ai) instead of the official Apple Developer documentation (developer.apple.com). Providing non-official links for sensitive privacy-related APIs (which manage keyboard and biometric data) is deceptive and could lead developers to rely on untrusted or manipulated resources.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes patterns for the ingestion and processing of sensitive telemetry that may contain untrusted user-generated content, creating a vulnerability surface.
- Ingestion points: Sensitive data is fetched via SRSensorReader for sensors such as .keyboardMetrics, .siriSpeechMetrics, and .messagesUsageReport (documented in SKILL.md and references/sensorkit-patterns.md).
- Boundary markers: The provided Swift code templates for processing results do not include delimiters or instructions for the agent to ignore embedded commands within the sensor data.
- Capability inventory: The skill provides logic for fetching and iterating through data that includes full transcriptions, sentiment analysis, and message counts.
- Sanitization: There is no evidence of data sanitization, validation, or escaping logic in the provided processing examples (e.g., processKeyboardMetrics or processSpeechMetrics).
Audit Metadata