wear-compose-m3
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches library version metadata from a well-known service to ensure project compatibility.
- Evidence: Accesses the official Maven metadata XML at
https://dl.google.com/dl/android/maven2/androidx/wear/compose/compose-material3/maven-metadata.xmlto identify the latest stable version. - [INDIRECT_PROMPT_INJECTION]: The skill processes project-specific build configuration files which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Reads
gradle/libs.versions.tomlandbuild.gradle.ktsfrom the project environment. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for these file reads in the skill body.
- Capability inventory: The skill is primarily instructional and provides guidance based on file contents; it does not explicitly invoke high-risk tools like arbitrary shell execution (in fact, it explicitly forbids running
./gradlewcommands to resolve versions). - Sanitization: No explicit content filtering or validation for the build file data is described.
Audit Metadata