mobile-power-profiling
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the user or agent to run a provided Python script (
scripts/compare-runs.py) to analyze power consumption data. - Evidence: The script is a standalone utility that uses standard Python libraries (
argparse,csv,json,math,statistics) to perform mathematical comparisons on CSV-formatted data. - [PRIVILEGE_ESCALATION]: The skill documentation describes enabling "Developer Mode" on iOS and iPadOS devices to facilitate performance tracing.
- Evidence: Found in
references/ios.md. The skill correctly identifies this as a platform-specific requirement for accessing advanced profiling features and includes explicit instructions to seek authorization from the device owner before making configuration changes. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data provided in a CSV file for analysis, creating a potential surface for indirect injection if the data were improperly handled.
- Ingestion points: The file
readings.csvis read by thecompare-runs.pyscript. - Boundary markers: The script enforces a strict schema requiring specific headers (
pair,variant,device,scenario,metric,unit,duration_s,value) and validates that values match expected numeric types or units. - Capability inventory: The processing script is limited to mathematical summarization and JSON output; it does not perform network operations, system-level modifications, or unsafe code execution.
- Sanitization: Input fields are stripped of whitespace and validated against allowed unit strings, while numeric fields are cast to floats with bounds checking (non-negative/finite).
Audit Metadata