android-reverse-engineering
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted external data (Android APK, XAPK, JAR, and AAR files). This creates an inherent attack surface where malicious artifacts could contain content designed to influence the agent's behavior during the analysis phase.
- Ingestion points: APK/XAPK/JAR/AAR files (SKILL.md).
- Boundary markers: None provided in the workflow description.
- Capability inventory: The file describes manual analysis steps such as tracing call flows and mapping packages; no automated subprocess calls or file-write capabilities are defined in this specific instructions file.
- Sanitization: None described for the analysis workflow.
- [SAFE]: The content is strictly informational and instructional. It lists prerequisites and provides templates for documentation without including any executable shell commands, remote download triggers, or automated scripts.
Audit Metadata