agp-9-upgrade
Warn
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: MEDIUMPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: The skill's metadata identifies 'Google LLC' as the author, which conflicts with the identified publisher 'IsKenKenYa.' This inconsistency is a form of metadata poisoning that can lead users to misattribute the skill's origin. Furthermore, the skill processes untrusted project files, creating an attack surface for indirect prompt injection.
- Ingestion points: User-provided Android project build scripts (e.g., build.gradle, build.gradle.kts) and configuration files (gradle.properties).
- Boundary markers: None identified; the instructions do not include specific delimiters or warnings to ignore embedded commands in the project data.
- Capability inventory: Execution of shell commands via the Gradle wrapper (./gradlew), file system modification, and reading of local dependency caches.
- Sanitization: None identified; project configuration content is used directly by the agent to perform the migration tasks.
- [COMMAND_EXECUTION]: The skill requires the agent to run the Gradle wrapper (./gradlew) with commands such as 'help' and 'build --dry-run' for project verification. It also suggests using tools to inspect the contents of JAR files within the local Gradle cache to verify KSP compatibility.
- [EXTERNAL_DOWNLOADS]: The skill references documentation and code examples from well-known and official sources, including developer.android.com and the android/gradle-recipes repository on GitHub.
- [DATA_EXFILTRATION]: The skill directs the agent to access the local Gradle cache directory (~/.gradle/caches/). Although this path is used to verify the compatibility of library artifacts and no network transmission of user data was observed, it is a sensitive local directory.
Audit Metadata