·
Last changedVersion:
This version passed the hardening gate. Hardening applied 2 targeted changes and preserved all other text. Classified findings before hardening: 2. Classified findings closed: 2. Classified findings remaining: 0. Unclassified scanner findings remaining: 0. Review findings closed: 3. Review findings remaining: 10.
2
None
Expand | File | Group | Subtype | Severity | Status |
|---|---|---|---|---|---|
templates/dogfood-report-template.md | Prompt Injection | Direct prompt injection | Medium | Closed | |
SKILL.md | Supply Chain & Install-Time Trust | — | Medium | Closed |
2 findings
Systematically explore a mobile app, find issues, and produce a report with full reproduction evidence for every finding.
Only the Target app is required. Everything else has sensible defaults.
| Parameter | Default | Example override |
|---|---|---|
Target app | (required) |
|
Platform | Infer from user context; otherwise ask ( |
|
Session name | Slugified app/platform (for example |
|
Output directory |
|
|
Scope | Full app |
|
Authentication | None |
|
If the user gives enough context to start, begin immediately with defaults. Ask follow-up only when a required detail is missing (for example platform or credentials).
Prefer direct agent-device binary when available.
Start a named session and launch target app:
If login is required:
For OTP/email codes: ask the user, wait for input, then continue.
Capture initial evidence and navigation anchors:
Map top-level navigation, tabs, and key workflows before deep testing.
Read references/issue-taxonomy.md for severity/category calibration.
Strategy:
diff snapshot -i after UI transitions to avoid stale refs.logs path and inspect the app log when behavior looks suspicious.Useful commands per screen:
Explore and document in one pass. When you find an issue, stop and fully capture evidence before continuing.
Use video + step screenshots:
Single screenshot is sufficient; no video required:
Set Repro Video to N/A in the report.
Target 5-10 well-evidenced issues, then finish:
report.md.@eN) for fast exploration, selectors for deterministic replay assertions when needed.fill for clear-then-type semantics; use type for incremental typing behavior checks.| Reference | When to Read |
|---|---|
Start of session; severity/categories/checklist |
| Template | Purpose |
|---|---|
Copy into output directory as the report file |
Get started with chainctlchainctl skill install public/callstackincubator/dogfood:latest
Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.
skills.cgr.dev/public/github.com/callstackincubator/plugins/vendored/.agents/skills/dogfood:latest
MIT
HARDENING.md
LICENSE
SKILL.md
references/issue-taxonomy.md
templates/dogfood-report-template.md