android-profiler
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches Android profiling helper scripts and the
trace_processorbinary from official Google repositories and domains (raw.githubusercontent.com/google/perfettoandget.perfetto.dev). These are necessary components for recording and analyzing Android performance data. - [COMMAND_EXECUTION]: Executes shell commands to record system traces, heap dumps, and CPU profiles using
adb(via helper scripts) and runstrace_processorto execute SQL queries against collected trace files. - [DYNAMIC_EXECUTION]: Downloads and executes external shell scripts and the
trace_processorbinary. Thetrace_processortool is designed to download platform-specific native binaries upon its first execution to facilitate trace parsing. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external Android trace files (
.pftrace,.perfetto-trace) for analysis. This represents an attack surface where data in a trace could theoretically influence the agent's analysis logic. - Ingestion points: Processes trace files provided as local file paths or remote URLs.
- Boundary markers: None (data is processed as a binary protobuf format).
- Capability inventory: The skill uses
trace_processorfor data extraction and writes analysis reports to markdown files. - Sanitization: No explicit sanitization of trace data content is performed before generating the analysis report.
Audit Metadata