Versioned security assessment

Report ID: SA-3E4B6C31

7/9/2026, 7:22:57 AM

mobile-debugging security assessment v12

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
mobile-debugging
Version
v12
Maintainer
BabakBar
Source
github.com/BabakBar/VibeKeeper/tree/main/.claude/skills/debugging
Coverage
1 Files scanned · 223 Lines analyzed
Policy version
Unavailable

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static findings are Markdown fences, official resource links, or local diagnostic steps, not hidden execution or exfiltration. I confirmed the cache deletion commands and force-kill command substitution as medium operational risks because the skill allows Bash. No prompt injection or malicious intent evidence was found.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 223 Lines analyzed

3 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 25 evidence locations

Capability review items (3)
Medium
SKILL.md:184
Shell command substitution
kill -9 $(lsof -ti:8081)
The command uses shell command substitution to pass any PID listening on port 8081 to kill -9. In a Bash-enabled skill this can terminate an unrelated local process if run without confirmation.
Medium
SKILL.md:31
Temp directory access
rm -rf /tmp/metro-*
The command deletes matching directories under /tmp with rm -rf as part of Metro cache cleanup. This is legitimate debugging guidance, but it can remove local files if run automatically or with an unexpected wildcard match.
Medium
SKILL.md:32
Temp directory access
rm -rf /tmp/haste-*
The command deletes matching directories under /tmp with rm -rf as part of Haste cache cleanup. This is legitimate debugging guidance, but it can remove local files if run automatically or with an unexpected wildcard match.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Destructive cache deletion examples
    Add explicit user confirmation before deleting Metro or Haste cache directories under /tmp, and explain the expected files first.
  2. FIX-002
    Medium
    Force-kill process command
    Prefer a graceful process stop, or ask the user to confirm the PID before running a kill -9 command on port 8081.
  3. FIX-003
    Low
    Bash-heavy troubleshooting guidance
    Tell agents to inspect errors and explain command effects before simulator resets, dependency reinstalls, global installs, or build cleans.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Content hash
c5a91e07c921bb9c07a2bf9f7a3a346d6598b167e3a9e04494d88d158eb142b3
Tree hash
58e473b24bcfddc54fc5746d6211e815028296cc0c254427a32b0417354ee7a3
Skill path
skills/babakbar/mobile-debugging
Audit payload hash
d4d3639fc0599dbdea5bbf0cdfaf2981

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable