rf-appium

Pass

Audited by Gen Agent Trust Hub on Mar 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install 'robotframework-appiumlibrary' via pip and 'appium' via npm, which are well-known and standard tools for mobile automation.
  • [COMMAND_EXECUTION]: The skill demonstrates the use of 'Execute Script' to run mobile-specific commands on Android (e.g., 'mobile: shell' for battery status) and interact with the clipboard, which are legitimate testing functions.
  • [REMOTE_CODE_EXECUTION]: Robot Framework's 'Evaluate' keyword is used to perform simple mathematical calculations for dynamic screen coordinates, presenting no security risk in this context.
  • [PROMPT_INJECTION]: The skill has a data ingestion surface through keywords like 'Get Text' and 'Get Source' that read content from the mobile application being tested. This is a standard requirement for mobile testing. Ingestion points: 'Get Text' and 'Get Source' in SKILL.md and various examples. Capability inventory: 'Execute Script' (shell, clipboard), 'Open Application', and 'Input Text'. Sanitization and boundary markers are not applicable to this documentation-only skill.
  • [SAFE]: Cloud testing examples for BrowserStack and Sauce Labs correctly utilize variable placeholders for authentication credentials, preventing the exposure of sensitive secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 29, 2026, 02:30 PM