mobile-ota-updates
Fail
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the user to install the Shorebird CLI using a command that pipes a remote shell script directly into bash (
curl ... https://raw.githubusercontent.com/shorebirdtech/install/main/install.sh | bash). This execution method allows for arbitrary remote code execution without validation of the script's contents. - [COMMAND_EXECUTION]: The skill provides commands for performing OTA updates and patches using the
easandshorebirdCLI tools. These tools possess the capability to modify application logic and transmit data over the network. - [INDIRECT_PROMPT_INJECTION]: The skill processes framework configuration files, which can serve as a vector for malicious instructions embedded in data.
- Ingestion points: Framework configuration is read from
app.jsonandeas.jsoncode blocks withinSKILL.md. - Boundary markers: No specific boundary markers or 'ignore' instructions are provided for the configuration snippets.
- Capability inventory: The skill uses tools (
eas,shorebird) that can publish code updates and perform network operations. - Sanitization: There are no procedures defined for sanitizing or validating the configuration data before it is processed by the deployment tools.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/shorebirdtech/install/main/install.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata