mobile-checkpoint
Pass
Audited by Gen Agent Trust Hub on Feb 20, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE] (SAFE): The skill is composed entirely of a markdown documentation file (
SKILL.md). No executable scripts (Python, JavaScript, Bash) or configuration files that could trigger automated execution were provided. - [COMMAND_EXECUTION] (SAFE): The markdown references standard development tools such as
gitand./gradlew. These are used in the context of project maintenance and state recovery, posing no inherent security risk as described. - [INDIRECT_PROMPT_INJECTION] (SAFE): While the skill mentions importing state from JSON files (
/mobile-checkpoint import), it is a documentation-only description without implementation. There is no active ingestion logic present to evaluate for sanitization or boundary markers. - [DATA_EXPOSURE] (SAFE): The workflow interacts with standard project files like
AndroidManifest.xmlandbuild.gradle.ktsfor local state tracking. No network-based exfiltration or access to sensitive user credentials (like SSH keys or AWS tokens) is suggested.
Audit Metadata