mobile-power-profiling

Pass

Audited by Gen Agent Trust Hub on Nov 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the user or agent to run a provided Python script (scripts/compare-runs.py) to analyze power consumption data.
  • Evidence: The script is a standalone utility that uses standard Python libraries (argparse, csv, json, math, statistics) to perform mathematical comparisons on CSV-formatted data.
  • [PRIVILEGE_ESCALATION]: The skill documentation describes enabling "Developer Mode" on iOS and iPadOS devices to facilitate performance tracing.
  • Evidence: Found in references/ios.md. The skill correctly identifies this as a platform-specific requirement for accessing advanced profiling features and includes explicit instructions to seek authorization from the device owner before making configuration changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data provided in a CSV file for analysis, creating a potential surface for indirect injection if the data were improperly handled.
  • Ingestion points: The file readings.csv is read by the compare-runs.py script.
  • Boundary markers: The script enforces a strict schema requiring specific headers (pair, variant, device, scenario, metric, unit, duration_s, value) and validates that values match expected numeric types or units.
  • Capability inventory: The processing script is limited to mathematical summarization and JSON output; it does not perform network operations, system-level modifications, or unsafe code execution.
  • Sanitization: Input fields are stripped of whitespace and validated against allowed unit strings, while numeric fields are cast to floats with bounds checking (non-negative/finite).
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 7, 2026, 06:54 PM