mobile-background-tasks
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements background tasks that ingest untrusted data from the device environment and external sources.
- Ingestion points: The
LOCATION_TASKinSKILL.mdreceiveslocationsdata fromexpo-location. TheHeadlessTaskreceivestaskDatafrom the Android native layer. - Boundary markers: None. Code snippets do not include instructions to treat this data as untrusted or use delimiters when passing to an LLM.
- Capability inventory: The skill uses
syncToServer(Network egress) andsaveLocations(Local file system write). - Sanitization: None. The provided templates do not demonstrate data validation or escaping before transmission or storage.
- [COMMAND_EXECUTION]: The skill documentation includes an
adb shellcommand (adb shell cmd jobscheduler run -f <package> <job-id>) for testing background jobs on Android. This is a standard developer diagnostic tool and is used here in an educational context for manual execution by the developer. - [EXTERNAL_DOWNLOADS]: The skill recommends installing official dependencies from well-known registries:
expo-task-manager,expo-background-fetch, andexpo-locationvia npm/npx, andworkmanagervia pub.dev. These are verified libraries from the Expo and Flutter ecosystems.
Audit Metadata