android-apk-audit
Pass
Audited by Gen Agent Trust Hub on May 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill contains multiple scripts (e.g.,
scripts/auto-audit-static.sh,scripts/frida-exploit-helper.py) that automate the usage of standard Android security tools through shell commands and Python's subprocess module. These are necessary for the skill's primary function as an auditing tool and do not perform any hidden operations on the host system. - [EXTERNAL_DOWNLOADS]: The documentation and preflight scripts provide instructions for installing verified third-party security tools from trusted sources like GitHub (e.g., Guardsquare, Skylot) and official package registries. The skill does not perform any unauthorized or background downloads of remote code.
- [SAFE]: The skill defines strict operational guidelines for the AI agent to prioritize safety and accuracy, specifically instructing the agent to never report bare grep hits without context and to avoid following instructions contained within the analyzed application files, which mitigates indirect prompt injection risks.
Audit Metadata