android

SUSPICIOUS. The skill’s Android/KMP capabilities and local Gradle/adb commands are coherent with its stated purpose, and there is no clear credential theft or exfiltration path in the supplied content. The main risk is transitive trust: it tells the agent to install additional skill content from an unpinned personal GitHub repository via the skills CLI, which expands trust without strong publisher verification.