use-mobile-device — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited use-mobile-device (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You have MCP tools for controlling iOS and Android devices. This skill covers how to use them effectively.
list_devices to get a valid device_id.screenshot to see the current screen.uitree to get elements with coordinates. Use the search param to filter by text.tap, type_text, scroll, press_button, long_press, double_tap, etc. Use the element's center field as tap coordinates.screenshot to confirm the result.Repeat 2-5 as needed.
uitree returns elements as JSONL. Each line is a JSON object with these fields (all always present):
| Field | Type | Description |
|---|---|---|
id | number | Sequential integer starting from 1 |
text | string | Element text (may be empty) |
type | string | Semantic type: button, input, text, switch, image, etc. |
bounds | object | {left, top, right, bottom} in screen coordinates |
center | object | {x, y} — center of bounds, ready to use as tap coordinates |
visible | boolean | Whether the element is within the screen bounds |
clickable | boolean | Whether the element accepts taps |
search to filter by text (case-insensitive substring match).limit to cap results when the tree is large.scroll to reveal it, then call uitree again.center coordinates for tapping, not visual estimation from screenshots.Tap the target text field first to focus it, then call type_text.
Scroll direction follows finger movement:
startY > endY (finger moves up).startY < endY (finger moves down).press_button accepts these values: home, back, volumeUp, volumeDown, enter, dpadUp, dpadDown, dpadLeft, dpadRight, dpadCenter. iOS only supports home.
long_press accepts an optional duration in milliseconds (1–10000, default 500).
list_apps returns installed app IDs.launch_app and terminate_app take app_id: bundle ID on iOS, package name on Android.Executes JavaScript on-device. Each call runs in a fresh context — no state persists between calls.
Returns { result: "last expression value", logs: ["console.log output", ...] }.
For detailed run_code API reference per platform, see examples/run-code-tool.md.
Sandboxed JS engine with UIAutomator bindings. Write JavaScript, not Java.
Global objects: uiDevice, By, Until, console.
// Find and click a button by text
var btn = uiDevice.findObject(By.text("Submit"));
btn.click();
// Wait for an element to appear
uiDevice.wait(Until.hasObject(By.res("com.app:id/done")), 5000);
// Screen dimensions — callable functions, not bare properties
var w = uiDevice.displayWidth();
var h = uiDevice.displayHeight();JS engine with XCUITest bindings. Write JavaScript, not Swift — use var for declarations, not typed let.
Global objects: app (foreground app), springboard, device, openApp(bundleId), sleep(ms), console.
// Tap a button by label
app.buttons["Login"].tap();
// Type into a text field
var field = app.textFields.firstMatch;
field.tap();
field.typeText("hello");
// Wait for element existence
var ok = app.buttons["OK"].waitForExistence(5);
// Query by predicate
var cells = app.cells.matchingPredicate("label CONTAINS 'Item'");uitree.screenshot.device_id from list_devices.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.