re-android-native
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses common shell utilities (unzip, find, file, readelf, adb) for binary extraction and identification. It also instructs the installation of dependencies using official system package managers including apt, dnf, pacman, brew, and pip.
- [EXTERNAL_DOWNLOADS]: The skill references downloading the Android NDK from Google's official SDK manager and well-known public GitHub repositories for environment setup.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes potentially untrusted Android .so (ELF) files, which serves as a vulnerability surface where malicious code within a binary could attempt to influence the analysis process. 1. Ingestion points: Native library files (.so) are extracted from APKs and processed via static analysis tools (readelf, Ghidra) and dynamic instrumentation (Frida). 2. Boundary markers: The instructions do not define specific boundary markers for the binary content, which is characteristic of reverse engineering workflows. 3. Capability inventory: The skill utilizes subprocess calls for analysis tools and runtime function hooking via Frida scripts. 4. Sanitization: The skill relies on manual expert analysis and tool-based parsing, specifically recommending that dynamic instrumentation be performed within controlled device environments or emulator snapshots to mitigate risks.
Audit Metadata