r8-analyzer
Fail
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: HIGHPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: \n- Metadata Poisoning: The skill's frontmatter identifies the author as "Google LLC," which is deceptive as the actual author is "IsKenKenYa." This impersonation of a trusted vendor can lead users to misplace trust in the skill's safety and recommendations.\n- Indirect Prompt Injection Surface: The skill processes untrusted external data from project build files and generated JSON data. It lacks boundary markers or explicit instructions to ignore embedded commands when interpolating this external data into the analysis process.\n
- Ingestion points: build.gradle, gradle.properties, and tmp/r8analysis/keepruleradius.json.\n
- Boundary markers: Absent (no delimiters or "ignore" instructions for external content).\n
- Capability inventory: Subprocess calls (via ./gradlew), file system operations, and Python script execution.\n
- Sanitization: Absent.\n- [COMMAND_EXECUTION]: \n- Shell Command Execution: The skill requires the agent to run shell commands including "./gradlew assembleRelease" and file management tasks. Running a full Gradle build involves executing arbitrary code defined in the project's build scripts, which can be risky if the project files are malicious.\n- Dynamic Python Execution: The skill includes complex Python scripts and protobuf bindings to be executed locally. While these scripts facilitate the R8 analysis, running provided code on local data poses a security risk if the environment is not isolated.
Recommendations
- AI detected serious security threats
Audit Metadata