mlkit-agent-api
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements an autonomous agent loop that ingests untrusted user strings to trigger local tool execution. Ingestion points:
ChatViewModel.sendMessage(prompt: String)inSKILL.md. Boundary markers: Absent; user content is passed directly to the model. Capability inventory: The agent has discovery and execution rights for Android AppFunctions (e.g.,fetch_calendar). Sanitization: Absent; no validation is performed on the prompt. - [EXTERNAL_DOWNLOADS]: Fetches official libraries from Google and AndroidX repositories. Evidence:
com.google.mlkit:genai-agent:1.0.0-alpha1andandroidx.appfunctions:appfunctions:1.0.0-alpha13inSKILL.md. - [SAFE]: The skill implements significant defensive measures including:
HitlConfirmationToolfor user consent on sensitive actions;ACCESS_LEVEL_SELFto prevent unauthorized tool access via IPC; and a defaultmaxTurnslimit of 10 to prevent denial-of-service through infinite reasoning loops.
Audit Metadata