mobile-background-tasks

Pass

Audited by Gen Agent Trust Hub on Jul 21, 2026

Risk Level: SAFE
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill implements background tasks that ingest untrusted data from the device environment and external sources.
  • Ingestion points: The LOCATION_TASK in SKILL.md receives locations data from expo-location. The HeadlessTask receives taskData from the Android native layer.
  • Boundary markers: None. Code snippets do not include instructions to treat this data as untrusted or use delimiters when passing to an LLM.
  • Capability inventory: The skill uses syncToServer (Network egress) and saveLocations (Local file system write).
  • Sanitization: None. The provided templates do not demonstrate data validation or escaping before transmission or storage.
  • [COMMAND_EXECUTION]: The skill documentation includes an adb shell command (adb shell cmd jobscheduler run -f <package> <job-id>) for testing background jobs on Android. This is a standard developer diagnostic tool and is used here in an educational context for manual execution by the developer.
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing official dependencies from well-known registries: expo-task-manager, expo-background-fetch, and expo-location via npm/npx, and workmanager via pub.dev. These are verified libraries from the Expo and Flutter ecosystems.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 21, 2026, 12:30 PM
Security Audit — agent-trust-hub — mobile-background-tasks