vita-app-port
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external data in the form of Android application source code and APK metadata during the triage and build phases.
- Ingestion points: The
audit_source.pyscript (referenced from thevita-portskill) reads the contents of the application source directory to determine feasibility and the required porting route. - Boundary markers: There are no instructions defining delimiters or "ignore embedded instructions" warnings for the agent when it processes or interprets the output of the auditing and build tools.
- Capability inventory: The skill utilizes
cmakefor build orchestration,python3for auditing and validation scripts, and performs file system operations to generate build artifacts and VPK packages. - Sanitization: The skill does not describe any sanitization, escaping, or validation of the external project code before it is passed to the build toolchain or the auditing scripts.
Audit Metadata