56 results available
Sign in
Skills directory

dogfood

callstackincubator

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 2. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 10.


Open before hardening

2

Medium
Open after hardening

None


Expand
File
Group
Subtype
Severity
Status
templates/dogfood-report-template.md

Prompt Injection

Direct prompt injection

Medium
Closed
SKILL.md

Supply Chain & Install-Time Trust

—

Medium
Closed

2 findings


SKILL.md

Dogfood (agent-device)

Systematically explore a mobile app, find issues, and produce a report with full reproduction evidence for every finding.

Setup

Only the Target app is required. Everything else has sensible defaults.

ParameterDefaultExample override

Target app

(required)

Settings, com.example.app, deep link URL

Platform

Infer from user context; otherwise ask (ios or android)

--platform ios

Session name

Slugified app/platform (for example settings-ios)

--session my-session

Output directory

./dogfood-output/

Output directory: /tmp/mobile-qa

Scope

Full app

Focus on onboarding and profile

Authentication

None

Sign in to user@example.com

If the user gives enough context to start, begin immediately with defaults. Ask follow-up only when a required detail is missing (for example platform or credentials).

Prefer direct agent-device binary when available.

Workflow

1. Initialize    Set up session, output dirs, report file
2. Launch/Auth   Open app and sign in if needed
3. Orient        Capture initial snapshot and map navigation
4. Explore       Systematically test flows and states
5. Document      Record reproducible evidence per issue
6. Wrap up       Reconcile summary, close session

1. Initialize

mkdir -p {OUTPUT_DIR}/screenshots {OUTPUT_DIR}/videos
cp {SKILL_DIR}/templates/dogfood-report-template.md {OUTPUT_DIR}/report.md

2. Launch/Auth

Start a named session and launch target app:

agent-device --session {SESSION} open {TARGET_APP} --platform {PLATFORM}
agent-device --session {SESSION} snapshot -i

If login is required:

agent-device --session {SESSION} snapshot -i
agent-device --session {SESSION} fill @e1 "{EMAIL}"
agent-device --session {SESSION} fill @e2 "{PASSWORD}"
agent-device --session {SESSION} press @e3
agent-device --session {SESSION} wait 1000
agent-device --session {SESSION} snapshot -i

For OTP/email codes: ask the user, wait for input, then continue.

3. Orient

Capture initial evidence and navigation anchors:

agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/initial.png
agent-device --session {SESSION} snapshot -i

Map top-level navigation, tabs, and key workflows before deep testing.

4. Explore

Read references/issue-taxonomy.md for severity/category calibration.

Strategy:

  • Move through each major app area (tabs, drawers, settings pages).
  • Test core journeys end-to-end (create, edit, delete, submit, recover).
  • Validate edge states (empty/error/loading/offline/permissions denied).
  • Use diff snapshot -i after UI transitions to avoid stale refs.
  • Periodically capture logs path and inspect the app log when behavior looks suspicious.

Useful commands per screen:

agent-device --session {SESSION} snapshot -i
agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/{screen-name}.png
agent-device --session {SESSION} appstate
agent-device --session {SESSION} logs path

5. Document Issues (Repro-First)

Explore and document in one pass. When you find an issue, stop and fully capture evidence before continuing.

Interactive/behavioral issues

Use video + step screenshots:

  1. Start recording:
agent-device --session {SESSION} record start {OUTPUT_DIR}/videos/issue-{NNN}-repro.mp4
  1. Reproduce with visible pacing. Capture each step:
agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}-step-1.png
sleep 1
# perform action
sleep 1
agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}-step-2.png
  1. Capture final broken state:
sleep 2
agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}-result.png
  1. Stop recording:
agent-device --session {SESSION} record stop
  1. Append issue immediately to report with numbered steps and screenshot references.
Static/on-load issues

Single screenshot is sufficient; no video required:

agent-device --session {SESSION} screenshot {OUTPUT_DIR}/screenshots/issue-{NNN}.png

Set Repro Video to N/A in the report.

6. Wrap Up

Target 5-10 well-evidenced issues, then finish:

  1. Reconcile summary severity counts in report.md.
  2. Close session:
agent-device --session {SESSION} close
  1. Report total issues, severity breakdown, and highest-risk findings.

Guidance

  • Repro quality matters more than issue count.
  • Use refs (@eN) for fast exploration, selectors for deterministic replay assertions when needed.
  • Re-snapshot after any mutation (navigation, modal, list update, form submit).
  • Use fill for clear-then-type semantics; use type for incremental typing behavior checks.
  • Keep logs optional and targeted: enable/read app logs only when useful for diagnosis.
  • Never read source code of the app under test; findings must come from observed runtime behavior.
  • Write each issue immediately to avoid losing evidence.
  • Never delete screenshots/videos/report artifacts during a session.

References

ReferenceWhen to Read

references/issue-taxonomy.md

Start of session; severity/categories/checklist

Templates

TemplatePurpose

templates/dogfood-report-template.md

Copy into output directory as the report file

Install

Install with chainctl
chainctl skill install public/callstackincubator/dogfood:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/callstackincubator/agent-skills
Upstream commit23643af0f725b83f2e3bfdb2c2f55bcca6d10e00
OCI reference

skills.cgr.dev/public/github.com/callstackincubator/plugins/vendored/.agents/skills/dogfood:latest

License

MIT

Files

HARDENING.md

LICENSE

SKILL.md

references/issue-taxonomy.md

templates/dogfood-report-template.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.