ui-state-design
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external companion skills from GitHub repositories (aldefy/compose-skill and skydoves/android-testing-skills). These are suggested for extended functionality, and the skill correctly directs users to a local configuration file for installation and verification commands rather than automating the process.
- [COMMAND_EXECUTION]: The documentation includes standard Android development commands (
./gradlew assembleDebug,test,lint) for project validation. These are static instructions and do not involve dynamic user input interpolation. - [PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from the user's project, such as ViewModel state models, repository results, and accessibility labels. While this represents a surface for indirect prompt injection where malicious instructions could be embedded in the code being analyzed, the risk is minimized as the skill's output is limited to design matrices and documentation, with no path to dynamic execution of that data.
Audit Metadata