install-android-skills

Pass

Audited by Gen Agent Trust Hub on Jun 22, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute shell scripts directly in the terminal using the curl | bash pattern. These scripts are sourced from Google's official download domain (dl.google.com) for installing the android CLI tool.
  • Evidence: curl -fsSL https://dl.google.com/android/cli/latest/linux_x86_64/install.sh | bash
  • Evidence: curl -fsSL https://dl.google.com/android/cli/latest/darwin_arm64/install.sh | bash
  • Evidence: curl -fsSL https://dl.google.com/android/cli/latest/darwin_x86_64/install.sh | bash
  • [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute a command using npx, which downloads and runs the skills package to add skills from the author's repository (IsKenKenYa/skills).
  • Evidence: npx skills@latest add IsKenKenYa/skills
  • [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a Windows command script to the temporary directory and execute it.
  • Evidence: curl -fsSL https://dl.google.com/android/cli/latest/windows_x86_64/install.cmd -o "%TEMP%\i.cmd" && "%TEMP%\i.cmd"
  • [EXTERNAL_DOWNLOADS]: The skill includes instructions to clone the official Android skills repository from GitHub.
  • Evidence: git clone https://github.com/android/skills.git
  • [COMMAND_EXECUTION]: The skill provides various shell commands for managing Android skills via the android CLI.
  • Evidence: android skills add --skill=r8-analyzer --project=.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 22, 2026, 10:16 AM
Security Audit — agent-trust-hub — install-android-skills