Versioned security assessment

Report ID: SA-80999BF5

7/18/2026, 10:15:34 AM

Mobile Debugging security assessment v16

Skill Security Certification Report

Audit History
Scanner version 3.0.0 Audit model: claude Latest published report
Skill name
Mobile Debugging
Version
v16
Maintainer
BabakBar
Source
github.com/BabakBar/VibeKeeper/tree/main/.claude/skills/debugging
Coverage
1 Files scanned · 223 Lines analyzed
Policy version
skillstore-security-audit-policy-v1

Confirmed finding summary

No confirmed security findings

The completed audit recorded no confirmed security findings. This is not proof that the Skill has no side effects.

Installation context

Check the current Skill page

This page summarizes report evidence only. The Skill page provides the canonical install advisory.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The skill is a React Native and Expo troubleshooting guide with no evidence of prompt injection, covert data collection, or unauthorized network activity. Several documented commands can delete caches or simulator data, alter builds, install packages, or terminate processes; users should review them before execution.

Report position

Latest published report

Latest refers to the report sequence, not to artifact currentness.

Audit attestation

Active attestation

A public attestation is available for this exact report.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 223 Lines analyzed

11 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Commit and path bound

  2. Artifact

    Content and tree hashes bound

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 3 evidence locations

Filesystem access

May read or write local files.

Observed in 2 evidence locations

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 25 evidence locations

Capability review items (11)
Medium
SKILL.md:24-33
Ruby/shell backtick execution
```bash
This command block directs the agent to run cache deletion and dependency reinstallation commands. These commands change the project and local development environment.
Medium
SKILL.md:37-46
Ruby/shell backtick execution
```bash
This command block runs pod reset, Gradle clean, and Expo prebuild commands that modify native build artifacts and project configuration.
Medium
SKILL.md:50-57
Ruby/shell backtick execution
```bash
This block can erase all iOS simulator data and terminate an Android emulator. Both actions are destructive to local test state.
Medium
SKILL.md:63-71
Ruby/shell backtick execution
```bash
This block installs a package globally and launches it. Global installation changes the host environment and resolves code from a package registry.
Medium
SKILL.md:75-85
Ruby/shell backtick execution
```bash
This block starts development tooling and reads device logs. It executes local package commands and can expose application diagnostic output.
Medium
SKILL.md:164-174
Ruby/shell backtick execution
```bash
This block executes diagnostic package and runtime commands, including dependency inspection. The commands are legitimate but execute local tooling.
Medium
SKILL.md:178-196
Ruby/shell backtick execution
```bash
This block includes process termination and ADB server commands. These actions alter local processes and connected Android device state.
Medium
SKILL.md:184
Shell command substitution
kill -9 $(lsof -ti:8081)
The command substitution passes the process ID from lsof to kill -9, forcibly terminating any process listening on port 8081.
Medium
SKILL.md:178-196
Template literal with command substitution
```bash
The cited block contains a kill command using shell command substitution, which can forcibly terminate a local process. The pattern overlaps the dedicated command-substitution finding.
Medium
SKILL.md:31
Temp directory access
rm -rf /tmp/metro-*
The instruction recursively deletes wildcard-matched directories under /tmp. A broad match can remove Metro or Haste temporary state used by other local work.
Medium
SKILL.md:32
Temp directory access
rm -rf /tmp/haste-*
The instruction recursively deletes wildcard-matched directories under /tmp. A broad match can remove Metro or Haste temporary state used by other local work.

Risk findings

Confirmed security concerns are separated from items that still need review.

No confirmed security findings were recorded for this completed audit.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Medium
    Destructive cleanup commands are presented without scope checks.
    Ask for confirmation before deleting dependencies, temporary directories, simulator data, or build artifacts, and explain the affected scope.
  2. FIX-002
    Medium
    The port cleanup command uses forceful process termination.
    Show the target process and request confirmation before using kill -9; prefer graceful termination when possible.
  3. FIX-003
    Medium
    The guide recommends a global package installation.
    Prefer a project-local or npx invocation and tell users to review the package source before installation.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
80999bf530a7874d7bedf8ce202001ecb4c4f5e0
Content hash
c5a91e07c921bb9c07a2bf9f7a3a346d6598b167e3a9e04494d88d158eb142b3
Tree hash
58e473b24bcfddc54fc5746d6211e815028296cc0c254427a32b0417354ee7a3
Skill path
skills/babakbar/mobile-debugging
Audit payload hash
3fbe843383556bc8aeec7f3f1cc34edb

Analysis metadata

Audit model: claude

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report Signed attestation CITATION.cff SARIF 2.1.0 Signed installation manifest Source

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: active