run-agent-device
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection because it ingests and processes untrusted data from the application under test, such as UI element text, network payloads, and logs.
- Ingestion points: Untrusted data enters the agent context through the outputs of
agent-device snapshot -i,agent-device network dump, andagent-device logs pathas described inSKILL.md,references/bug-triage.md, andreferences/command-map.md. - Boundary markers: The instructions do not define clear delimiters or provide specific warnings to the agent to ignore instructions that might be embedded in the UI elements or log files of the app being tested.
- Capability inventory: The skill uses the
agent-devicetool which has significant capabilities, including UI interaction (press,fill,click), environment control (settings clear-app-state,settings permission reset), and evidence collection, as detailed inSKILL.mdandreferences/command-map.md. - Sanitization: There is no evidence of sanitization, filtering, or validation of the content retrieved from the iOS simulator or device before it is processed by the agent.
Audit Metadata