mobile-app-flows

Warn

Audited by Gen Agent Trust Hub on Mar 20, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute a variety of commands including adb, ssh, flutter, node, sed, jq, cwebp, ffmpeg, and custom CLIs (agent-flutter, flow-walker).
  • [COMMAND_EXECUTION]: Modifies system-level settings on the Android emulator by using adb shell to change locales (settings put system system_locales en-US).
  • [COMMAND_EXECUTION]: Accesses and modifies private application data (shared preferences) using adb shell run-as to read and manipulate internal XML files.
  • [REMOTE_CODE_EXECUTION]: Instructs the agent to perform remote command execution on a specific host (beastoin-agents-f1-mac-mini) via ssh to capture screenshots and manage Flutter processes on a physical device.
  • [EXTERNAL_DOWNLOADS]: Transmits screenshots, timestamps, and execution logs to an external domain (flow-walker.beastoin.workers.dev) when using the push command to publish test reports.
  • [PROMPT_INJECTION]: Presents a surface for indirect prompt injection (Category 8) by ingesting live application UI text and transcript segments through agent-flutter snapshot. This content is used to drive subsequent agent actions (tapping buttons, filling fields) without explicit sanitization or boundary markers, creating a path for malicious app content to influence agent behavior.
  • [COMMAND_EXECUTION]: Employs dynamic process management and signal sending, such as kill -SIGUSR2 $(pgrep -f "flutter_tools.*run" | head -1), to trigger hot restarts in the development environment.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 20, 2026, 04:01 AM