appfunctions
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions and migration guides suggest adding dependencies on the androidx.appfunctions and androidx.appfunctions.compiler libraries, which are part of the Android Jetpack suite hosted on Google's Maven repository.
- [COMMAND_EXECUTION]: The skill provides commands to interact with a connected Android device or emulator using adb shell for tasks like listing, invoking, and managing the state of registered app functions. Evidence is found in references/adb-interaction-testing.md and references/migrate-to-service-entry-point.md.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions create a potential surface for indirect prompt injection. 1. Ingestion points: Where untrusted data enters agent context: The agent reads the description field from the output of adb shell cmd app_function list-app-functions and performs static analysis on project source files (specified in references/adb-interaction-testing.md and references/feature-discovery-analysis.md). 2. Boundary markers: No boundary markers or warnings are present to delimit embedded instructions; instead, the skill explicitly directs the agent to treat the description field as a set of instructions it must follow. 3. Capability inventory: The agent has the capability to execute shell commands on a device via adb and write/modify local project files. 4. Sanitization: No sanitization, escaping, or validation of the external metadata content is specified.
Audit Metadata