mobilerun-control
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads and processes UI text from a mobile device using mobilerun device ui and screenshots. An adversarial application could display text instructions intended to manipulate the agent's behavior.
- Ingestion points: scripts/mr-snap.sh captures UI trees and screenshots via mobilerun device ui and mobilerun device screenshot.
- Boundary markers: The skill does not implement explicit boundary markers or instructions to the agent to disregard instructions embedded in the mobile UI.
- Capability inventory: The agent has extensive capabilities including jittered tapping (mr-tap.sh), human-cadence typing (mr-type.sh), and launching arbitrary applications (mobilerun device start).
- Sanitization: No sanitization or filtering of screen content is performed before the agent processes it.
- [COMMAND_EXECUTION]: The skill executes various system-level commands using adb and mobilerun to control the connected device and modify settings.
- Evidence: scripts/mr-preflight.sh uses adb shell settings put secure to enable accessibility services and adb shell pm list packages to inspect installed applications. This is necessary and documented functionality for the skill's core purpose.
Audit Metadata