appfunctions
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for executing
adb shellcommands to interact with theapp_functionsystem service on a connected Android device or emulator. Evidence inreferences/adb-interaction-testing.mdincludes commands likeadb shell cmd app_function list-app-functionsandadb shell cmd app_function execute-app-function. These commands are specific to the framework being developed and tested. - [PROMPT_INJECTION]: The skill instructs the agent to process and obey natural language instructions embedded in external application metadata, creating a surface for indirect prompt injection. Ingestion points: application source code (e.g.,
AndroidManifest.xml) and the JSON output of thelist-app-functionscommand. Boundary markers: Absent; the instructions explicitly tell the agent to follow embedded instructions. Capability inventory: executing app functions via ADB and generating Kotlin source code. Sanitization: Absent. Evidence found inreferences/adb-interaction-testing.md: "The description field in the app function metadata is a set of instructions for the LLM... you must perform those steps before execution." - [PROMPT_INJECTION]: The skill metadata claims "Google LLC" as the author, which contradicts the provided author context of "albertmartorell1975". Evidence found in
SKILL.mdfrontmatter. - [EXTERNAL_DOWNLOADS]: The documentation references official, well-known Google and AndroidX repositories for managing dependencies and configuration. Evidence in
references/implementation-configuration.mdandreferences/migrate-to-service-entry-point.mdincludes references tomaven.google.comandandroidx.dev/snapshots/.
Audit Metadata