install-android-skills
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill provides instructions to download and execute shell scripts directly in the terminal using the
curl | bashpattern. These scripts are sourced from Google's official download domain (dl.google.com) for installing theandroidCLI tool. - Evidence:
curl -fsSL https://dl.google.com/android/cli/latest/linux_x86_64/install.sh | bash - Evidence:
curl -fsSL https://dl.google.com/android/cli/latest/darwin_arm64/install.sh | bash - Evidence:
curl -fsSL https://dl.google.com/android/cli/latest/darwin_x86_64/install.sh | bash - [REMOTE_CODE_EXECUTION]: The skill instructs the user to execute a command using
npx, which downloads and runs theskillspackage to add skills from the author's repository (IsKenKenYa/skills). - Evidence:
npx skills@latest add IsKenKenYa/skills - [EXTERNAL_DOWNLOADS]: The skill provides instructions to download a Windows command script to the temporary directory and execute it.
- Evidence:
curl -fsSL https://dl.google.com/android/cli/latest/windows_x86_64/install.cmd -o "%TEMP%\i.cmd" && "%TEMP%\i.cmd" - [EXTERNAL_DOWNLOADS]: The skill includes instructions to clone the official Android skills repository from GitHub.
- Evidence:
git clone https://github.com/android/skills.git - [COMMAND_EXECUTION]: The skill provides various shell commands for managing Android skills via the
androidCLI. - Evidence:
android skills add --skill=r8-analyzer --project=.
Audit Metadata