The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill instructs the agent to download the official MobSF Docker image from the opensecurity organization to perform analysis.- [COMMAND_EXECUTION]: The instructions include template curl commands to interact with the MobSF REST API on a local host for uploading binaries, triggering scans, and retrieving reports.- [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection due to its core function of processing external application data.
Ingestion points: Untrusted mobile application binaries (APK, IPA, ZIP) and the resulting JSON scan reports are processed by the agent to generate summaries.
Boundary markers: The instructions lack explicit delimiters or instructions to treat data from the scan reports as untrusted content, which could lead the agent to follow instructions embedded within the analyzed application's metadata or code.
Capability inventory: The skill utilizes curl for network communication with a local service and performs file system writes by redirecting command output to JSON files.
Sanitization: No sanitization or validation logic is defined for the data extracted from the external scan reports before it is presented to the user.

mobile-security-mobsf