android-java

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The included GitHub Actions workflow fetches and runs external action repositories at CI runtime (e.g., actions/checkout@v4, actions/setup-java@v4, gradle/actions/setup-gradle@v3, actions/upload-artifact@v4, reactivecircus/android-emulator-runner@v2), which execute remote code and are required for the pipeline to run.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The GitHub Actions workflow includes a step that runs sudo to write a udev rule to /etc/udev/rules.d and reload udev (modifying system files requiring elevated privileges), so it directs the agent to perform privileged system modifications.