The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Android symbol artifacts (ZIP files) from api.codemagic.io and signed Google Cloud Storage URLs at storage.googleapis.com/codemagic-build-artifacts/. The implementation uses a hardened redirect handler that validates destinations against an allowlist and ensures sensitive authentication tokens are not leaked across domains during redirects.
[COMMAND_EXECUTION]: The skill invokes local command-line tools to process build artifacts, including unzip, the optional gh CLI for metadata resolution, and Android NDK utilities (llvm-addr2line, llvm-readelf) for address resolution. These executions use safe subprocess patterns with static argument lists to avoid shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill processes stacktrace logs and R8 mapping files which represent an untrusted input surface. However, the logic uses strict regex-based parsing and the skill contains specific regression tests (tests/metachars.bats) to ensure that shell metacharacters within stacktrace frames or mapping entries are treated as literal data and not interpreted as commands.
Ingestion points: TRACE_FILE and MAPPING_FILE processed in scripts/symbolize_flutter_anr.sh and scripts/deobfuscate_r8.py.
Boundary markers: The skill processes files into symbolized text logs; it does not explicitly define prompt boundaries for the agent when reading the results, but the scripts implement data-only processing.
Capability inventory: Local file system access for artifact caching, and subprocess execution for standard development tools.
Sanitization: Strict regex capture groups in Bash and Python ensure only expected patterns (addresses, paths, method names) are extracted from input files, and length limits are enforced on mapping files to prevent resource exhaustion.

symbolize-android-stacktrace