The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The application code in VotingContract.kt contains a hardcoded administrative secret.
Evidence: private val ADMIN_SECRET = ByteArray(32) { 0x42 } in data/VotingContract.kt.
Impact: This static secret is used to derive the administrative key for the smart contract. Any user who decompiles the APK can retrieve this value and gain administrative control (e.g., closing polls) over contracts deployed using this implementation.
[COMMAND_EXECUTION]: The skill provides numerous shell commands for managing the toolchain, compiling smart contracts, and building the Android application.
Evidence: Commands such as compact update 0.31.0, npm run compile:voting, mn localnet up, and ./gradlew :app:installDebug are recommended for development setup.
[EXTERNAL_DOWNLOADS]: The skill configures the project to fetch build tools and software dependencies from external servers.
Evidence: The Gradle wrapper downloads its distribution from services.gradle.org, and the project pulls necessary libraries from the NPM registry and Maven Central.
[PROMPT_INJECTION]: The application creates an indirect prompt injection surface by ingesting and rendering untrusted data from the Midnight Network blockchain ledger.
Ingestion points: Untrusted poll question and option strings are read from the ledger in VotingContract.kt using the ledger.getStringOrNull method.
Boundary markers: The provided code snippets do not include explicit delimiters or warnings to the user or agent regarding the potentially adversarial nature of blockchain content.
Capability inventory: The analyzed application code does not demonstrate high-risk capabilities such as arbitrary shell command execution or dynamic code evaluation based on the ingested data.
Sanitization: No sanitization or escaping of the ledger-derived strings is evident before they are updated in the UI state and displayed to the user.

android-example-voting