contentsquare-android-sdk
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches SDK version information and metadata from Maven Central (
repo1.maven.org), which is the standard trusted package registry for Android development. - [COMMAND_EXECUTION]: Executes
curlcommands to reach the Contentsquare healthcheck endpoint (mobile-production.content-square.net). This is a documented diagnostic procedure used to verify project IDs and configuration before integration. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data during the mandatory healthcheck phase, creating a surface for indirect instructions.
- Ingestion points: Data is fetched from the vendor's healthcheck JSON endpoint as described in
SKILL.md. - Boundary markers: The instructions do not specify delimiters or safety warnings for the API response content.
- Capability inventory: The agent uses
curlfor network requests and reads project configuration files (build.gradle,AndroidManifest.xml) to resolve project identifiers inSKILL.md. - Sanitization: No explicit sanitization or validation of the fetched JSON content is defined before the agent incorporates the information into its summary report.
Audit Metadata