mobile-deep-linking-app-links
Pass
Audited by Gen Agent Trust Hub on Nov 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to handle untrusted external input via mobile deep links, which presents a surface for injection attacks where malicious URLs could attempt to force the application into unauthorized states or access sensitive screens.
- Ingestion points: Data enters the application context through platform APIs such as
Linking.useURL()andLinking.getInitialURL(), as detailed inexamples/core.md. - Boundary markers: Not present for the raw URL data strings.
- Capability inventory: The skill facilitates automated navigation to application routes and the passing of parameters to functional screens based on URL content.
- Sanitization: The skill provides a specific best-practice pattern for URL validation and parameter sanitization (Pattern 4 in
examples/core.md). This includes path allowlisting, parameter length limits, and character filtering (replace(/[<>]/g, "")) to mitigate common injection vectors. - [EXTERNAL_DOWNLOADS]: The skill references standard and reputable Node.js packages for mobile development, including
expo-linking,@react-navigation/native, andexpo-router. These dependencies are well-known, versioned appropriately in production contexts, and essential for the stated deep-linking functionality.
Audit Metadata