r8-analyzer
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of shell commands to perform its analysis. This includes creating and removing local directories (
mkdir,rm) and running the project's build tool (./gradlew assembleRelease) with specific system properties to generate diagnostic data. - [PROMPT_INJECTION]: The skill ingests untrusted data from project files (e.g.,
build.gradle,gradle.properties) and build-generated artifacts (.pb,.json) without explicit boundary markers or sanitization. This creates a surface for indirect prompt injection where instructions hidden in build files could influence the agent's behavior during report generation. - [EXTERNAL_DOWNLOADS]: The skill depends on the installation of the
protobufPython package and references documentation and source code repositories hosted on official Android and library-specific GitHub organizations. - [SAFE]: The skill's operations are performed locally on the user's project artifacts. It does not attempt to access sensitive credentials (like AWS keys or SSH identities) or exfiltrate data to external servers. All provided Python scripts are transparent and serve legitimate data transformation purposes.
Audit Metadata