migrate-xml-views-to-jetpack-compose
Warn
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill workflow requires the agent to execute shell commands and build system tasks. This includes running UI Automator or Espresso tests for screenshot capture in Step 4, performing Gradle syncs to resolve new dependencies in Step 5, and executing file system deletions to remove legacy XML resources in Step 10.
- [EXTERNAL_DOWNLOADS]: Step 5 specifies the addition of numerous Jetpack Compose libraries and compiler plugins. These resources are fetched from well-known technology vendor repositories (Google's Maven repository) and are documented neutrally as they involve established services.
- [DATA_EXFILTRATION]: Step 4 involves capturing screenshots of the application's UI for visual validation. This operation exposes the visual state of the application, which may contain sensitive user information or business data, representing a data capture risk.
- [PROMPT_INJECTION]: The skill exhibits two risks in this category: 1. Metadata Deception: The skill's YAML frontmatter identifies the author as 'Google LLC', which is deceptive as the actual skill origin is an independent user. This misrepresentation can cause an agent or user to misjudge the trust level and safety of the instructions. 2. Indirect Injection Surface: The skill is susceptible to indirect prompt injection (Category 8) because it ingests untrusted codebase data (XML layout files) while possessing high-privilege capabilities including shell execution and file deletion. It lacks explicit boundary markers or sanitization logic for handling potentially malicious content within the processed files.
Audit Metadata