react-native-device-data-module
Warn
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: MEDIUMCREDENTIALS_UNSAFEDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill facilitates access to authentication credentials stored in device storage. • Evidence: SKILL.md and rules/platform-key-mapping.md define mappings for 'accessToken', 'refreshToken', and 'expiresTimestamp'.\n- [DATA_EXFILTRATION]: The skill identifies and maps highly sensitive personally identifiable information (PII) to the agent context. • Evidence: Key mapping in rules/platform-key-mapping.md includes 'userSSN' (Social Security Number) and 'deviceId'. • Evidence: Dynamic key construction for 'userSSN' allows for targeted retrieval of specific user data.\n- [PROMPT_INJECTION]: The skill introduces a significant attack surface for indirect prompt injection by ingesting data from mobile storage. • Ingestion points: Native storage (UserDefaults and SharedPreferences) as accessed via UnifiedDeviceDataModule in SKILL.md. • Boundary markers: Absent; no delimiters or 'ignore' instructions are specified for stored data. • Capability inventory: Reading and transforming sensitive device data including PII and tokens. • Sanitization: Absent; no evidence of validation or filtering for retrieved storage values is provided.
Audit Metadata