Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.
Single tool 'deeplinkfuzz_scan' has a reasonable description (127 chars, within 10-1024 range) but critical schema deficiencies. Input schema is minimal: only 'target' parameter with type 'string' and basic description. No output schema documented. Parameter lacks format constraints, range limits, or validation guidance. No error handling patterns, no recovery guidance, no idempotency declaration. Tool name uses verb_noun pattern correctly but lacks composition clarity, unclear what 'fuzzes' returns or how to chain results. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Description does not explain prerequisites (emulator/device availability), expected input format (path vs manifest file), or output structure. Baseline: 100% of A+ tools document return types; this tool does not.
Fuzzes Android/iOS deep links, intents, and custom URL schemes against an emulator/device to surface unvalidated-redirect, injection, and component-hijack bugs.. Returns JSON findings.
No output schema documented. LLMs cannot plan downstream operations or extract findings without knowing response structure (fields, types, nesting).
Input parameter 'target' lacks format constraints, validation rules, or examples. Description does not specify: is it a file path, directory, or manifest filename? What formats are accepted? What happens if path does not exist?
No error handling guidance. Tool description does not explain failure modes (missing emulator, invalid manifest, permission denied) or recovery steps. LLMs cannot self-correct on errors.
No tool annotations. Missing readOnlyHint (this is read-only), idempotentHint (safe to retry), or destructiveHint. Agents cannot reason about retry safety or side effects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Description does not state prerequisites or dependencies. Requires Android/iOS emulator or device to be running, this is a critical precondition agents must know before calling.