The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the mobile project being audited, which could potentially contain malicious instructions intended to influence the agent's behavior.
Ingestion points: The agent reads AndroidManifest.xml, build.gradle.kts, fastlane/metadata/ files, and project dependency lists (deps.txt).
Capability inventory: The skill has the capability to execute shell commands (grep, curl, bundletool, identify, convert), run the project's Gradle wrapper (./gradlew), and execute internal Python scripts.
Boundary markers: There are no explicit boundary markers or instructions to treat the ingested content as untrusted data.
Sanitization: No sanitization or filtering is applied to the data extracted from the project files before it is used in the agent's context.
[COMMAND_EXECUTION]: The skill instructs the agent to execute a variety of shell commands to perform its audit tasks.
Evidence: The instructions include running ./gradlew :app:dependencies and ./gradlew :app:processReleaseManifest, which executes scripts within the user's workspace. It also uses bundletool for manifest analysis and curl for verifying external privacy policy URLs. While these are standard tools for Android development, they represent a potential attack surface if the workspace environment or the provided URLs are malicious.

play-store-listing