android-profiler

Pass

Audited by Gen Agent Trust Hub on Sep 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches Android profiling helper scripts and the trace_processor binary from official Google repositories and domains (raw.githubusercontent.com/google/perfetto and get.perfetto.dev). These are necessary components for recording and analyzing Android performance data.
  • [COMMAND_EXECUTION]: Executes shell commands to record system traces, heap dumps, and CPU profiles using adb (via helper scripts) and runs trace_processor to execute SQL queries against collected trace files.
  • [DYNAMIC_EXECUTION]: Downloads and executes external shell scripts and the trace_processor binary. The trace_processor tool is designed to download platform-specific native binaries upon its first execution to facilitate trace parsing.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests external Android trace files (.pftrace, .perfetto-trace) for analysis. This represents an attack surface where data in a trace could theoretically influence the agent's analysis logic.
  • Ingestion points: Processes trace files provided as local file paths or remote URLs.
  • Boundary markers: None (data is processed as a binary protobuf format).
  • Capability inventory: The skill uses trace_processor for data extraction and writes analysis reports to markdown files.
  • Sanitization: No explicit sanitization of trace data content is performed before generating the analysis report.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 26, 2026, 04:20 PM