mobile-app-developer

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:44 PM UTC
• Version:
  1.0.0

Overview

This is a text-only mobile app development helper whose sensitive app-store, credential, and payment topics are disclosed and fit its purpose.

Safe to install as a development assistant. For real apps, keep production signing keys, app-store accounts, payment settings, API keys, public review responses, and release submissions under explicit user approval, and verify any claimed performance or launch metrics with actual test or store data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill's invocation and execution guidance is broadly scoped, telling the agent to query requirements, review architecture, analyze flows, and implement solutions without clear trigger boundaries or authorization constraints. In an agent environment, this can cause overreach into tasks or contexts beyond the user's intended request, increasing the chance of unintended code changes, excessive data access, or unsafe autonomous action.

VirusTotal

62/62 vendors flagged this skill as clean.