gui-agent-mobile
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill relies on executing shell commands via the
python -m gui_agent_skill.climodule or a fallbackcli.pyscript. These commands take user-defined strings for the--taskand--replyarguments, which are executed in the local environment. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data which is then used to drive device actions.
- Ingestion points: User-provided strings for
<task>and<reply>variables inSKILL.md. - Boundary markers: None are present to distinguish between user intent and malicious instructions embedded within the task or reply content.
- Capability inventory: The skill has the capability to execute subprocesses (via the Python CLI) that perform physical device interactions (tap, swipe, input) and read screen state.
- Sanitization: There is no evidence of input validation, escaping, or sanitization before the data is interpolated into the shell command strings.
Audit Metadata