mobile-analytics
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted data from the analyzed codebase to generate its report. * Ingestion points: Phase 1 through Phase 8 involve reading and mapping the entire application codebase. * Boundary markers: The instructions do not specify the use of delimiters or 'ignore' warnings for content parsed from the codebase. * Capability inventory: The skill reads local files and writes telemetry logs to the user's project directory. * Sanitization: No explicit sanitization of codebase content is performed before analysis.
- [SAFE]: The skill includes a self-evolution telemetry feature that appends execution metadata to a log file within the local directory (~/.claude/projects/). This is a standard logging mechanism for skill improvement and does not involve unauthorized network communication or sensitive data exfiltration.
Audit Metadata