device-integrity
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides standard instructional content and Swift code snippets for implementing Apple's DeviceCheck and App Attest security frameworks.
- [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where a backend server ingests untrusted attestation and assertion data from mobile clients. Mandatory Evidence: 1. Ingestion points: Server endpoints described in references/device-integrity-patterns.md for attestation and assertion verification. 2. Boundary markers: The skill instructs using SHA256 hashing of challenges and CBOR structure validation as delimiters. 3. Capability inventory: The skill provides server-side logic for cryptographic verification and public key storage. 4. Sanitization: Detailed procedures for certificate chain validation, OID extension checking (1.2.840.113635.100.8.2), and signature verification are provided to ensure data integrity and mitigate malicious injection.
Audit Metadata