The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses local development tools including adb, emulator, and flutter to manage the Android device lifecycle and run applications. These are expected capabilities for its described purpose.
[INDIRECT_PROMPT_INJECTION]: The skill retrieves UI labels and hierarchy data from the running Android application. It correctly identifies this as a potential attack surface and implements several mitigations:
Ingestion points: Data is pulled from the device via adb uiautomator dump (scripts/emu.sh).
Boundary markers: The output is explicitly wrapped in <untrusted-ui-data> and <untrusted-ui-xml> tags with clear warnings instructing the agent to treat the content as data only.
Capability inventory: Capabilities include sending touch events, launching packages, and running the Flutter daemon.
Sanitization: The script uses Python's repr() function to sanitize and escape labels before they are presented to the agent, neutralizing control characters and terminal injection attempts.
[SAFE]: The skill implements strong input validation. A dedicated require_int function sanitizes coordinate, duration, and line-count parameters to ensure they are strictly numeric before being passed to bash arithmetic operations or shell commands, effectively preventing injection attacks. Additionally, the skill uses safe array-based execution for the flutter CLI to avoid unintended shell evaluation of environment variables.

android-emulator