appfunctions

Pass

Audited by Gen Agent Trust Hub on Aug 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for executing adb shell commands to interact with the app_function system service on a connected Android device or emulator. Evidence in references/adb-interaction-testing.md includes commands like adb shell cmd app_function list-app-functions and adb shell cmd app_function execute-app-function. These commands are specific to the framework being developed and tested.
  • [PROMPT_INJECTION]: The skill instructs the agent to process and obey natural language instructions embedded in external application metadata, creating a surface for indirect prompt injection. Ingestion points: application source code (e.g., AndroidManifest.xml) and the JSON output of the list-app-functions command. Boundary markers: Absent; the instructions explicitly tell the agent to follow embedded instructions. Capability inventory: executing app functions via ADB and generating Kotlin source code. Sanitization: Absent. Evidence found in references/adb-interaction-testing.md: "The description field in the app function metadata is a set of instructions for the LLM... you must perform those steps before execution."
  • [PROMPT_INJECTION]: The skill metadata claims "Google LLC" as the author, which contradicts the provided author context of "albertmartorell1975". Evidence found in SKILL.md frontmatter.
  • [EXTERNAL_DOWNLOADS]: The documentation references official, well-known Google and AndroidX repositories for managing dependencies and configuration. Evidence in references/implementation-configuration.md and references/migrate-to-service-entry-point.md includes references to maven.google.com and androidx.dev/snapshots/.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 10, 2026, 03:18 PM
Security Audit — agent-trust-hub — appfunctions