dt-setup-android
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard operating system commands to search the project structure and verify the build environment.
- Searches for project modules and entry-point files using
grep(macOS/Linux),findstr(Windows CMD), orGet-ChildItem(PowerShell). - Executes
./gradlew --versionto verify compatibility of the Gradle, JVM, and Android Gradle Plugin versions. - Runs
./gradlew tasksto identify available build tasks and executes the chosenassembletask to verify the instrumentation. - [EXTERNAL_DOWNLOADS]: The skill adds a vendor-provided dependency to the project's build configuration.
- Fetches the
com.dynatrace.tools.android:gradle-pluginfrom Maven Central, which is the official plugin for Dynatrace Android instrumentation. - [REMOTE_CODE_EXECUTION]: The skill modifies build scripts and then triggers a project build, which executes the newly added configuration.
- Appends the Dynatrace instrumentation plugin and configuration blocks to
build.gradleorbuild.gradle.ktsfiles. - Triggers the execution of the modified build scripts by running the project's Gradle wrapper.
- [PROMPT_INJECTION]: The skill processes project files which serves as an indirect prompt injection surface.
- Ingestion points: Reads local project files including
build.gradle,settings.gradle,AndroidManifest.xml, and Java/Kotlin source files into the agent's context to identify configuration points. - Boundary markers: The instructions do not specify the use of delimiters or specific warnings when processing these external file contents.
- Capability inventory: The skill possesses file read/write capabilities, can execute shell searches, and can trigger build system execution.
- Sanitization: Content read from the project files is used for logic branching (e.g., path discovery) without explicit sanitization or filtering.
Audit Metadata