rnd-android-performance-analyzer
Pass
Audited by Gen Agent Trust Hub on Mar 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious behavior, obfuscation, or data exfiltration patterns were detected in the skill instructions or reference documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, specifically Android system logs (logcat) and performance trace files (systrace/perfetto).
- Ingestion points: User-provided logs and trace files defined in SKILL.md (Stage 2) and the performance framework.
- Boundary markers: Absent; there are no specific instructions to the agent to treat input data as non-executable or to use delimiters to prevent instruction injection from within log files.
- Capability inventory: The skill is limited to text-based analysis and reporting; it does not possess file-writing, network communication, or arbitrary command execution capabilities.
- Sanitization: Not present. While the ingestion of untrusted data represents a theoretical injection surface, the lack of powerful tools or capabilities significantly mitigates the risk.
- [COMMAND_EXECUTION]: The documentation includes shell commands (e.g.,
grep,cat,dumpsys,traceconv) for data extraction and conversion. These are provided as technical guidance for the user or as patterns for the agent to recognize in provided data, rather than instructions for the agent to execute commands directly on the host system.
Audit Metadata