agent-device-lab
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes standard platform utilities for mobile development, including Android Debug Bridge (
adb) and Xcode Command Line Tools (xcrun devicectl), to perform host diagnostics and device discovery. - [EXTERNAL_DOWNLOADS]: Provides instructions to install an upstream skill from the Callstack GitHub organization using the platform's skill manager (
npx skills add callstack/agent-device). It also references official documentation from Google, Apple, and Callstack. - [INDIRECT_PROMPT_INJECTION]: As the skill ingests and processes output from external CLI tools (
adb,xcrun), it addresses the potential for data leakage or injection by explicitly instructing the agent to scrub device identifiers, account names, and private data from logs and screenshots before sharing outputs. It also mandates the use ofumask 077to ensure that any generated state or evidence files are not world-readable.
Audit Metadata