re-hybrid-app
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user/agent to download several tools from external sources, including a repository on a well-known service (GitHub) and various official package managers (pip, apt, dnf, pacman, brew).
- [COMMAND_EXECUTION]: The skill contains numerous shell commands for tool installation, binary file inspection (using
unzip,grep,file), and executing analysis scripts such asblutter.py,reflutter, andhbc-decompiler. - [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for processing untrusted external data (APK files, compiled SO libraries, and JavaScript bundles) using automated tools, which represents an attack surface for indirect prompt injection.
- Ingestion points: The skill instructions lead to the processing of external
libapp.soandindex.android.bundlefiles viablutterandhermes-dec. - Boundary markers: Absent.
- Capability inventory: The skill utilizes shell command execution, file system access, and network proxy configuration via
adb. - Sanitization: Absent; the skill does not specify sanitization of the output from the analysis tools before it is presented to the agent.
Audit Metadata