android-gradle-build-performance
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The
audit_build_performance.pyscript parses user-provided Gradle build files (.gradle,.kts,.properties) to identify performance smells. While this creates a processing surface for external data, the script uses static string matching and regular expressions without executing the file content, posing no significant risk of code execution. Findings are presented as a diagnostic report to the agent. - [EXTERNAL_DOWNLOADS]: The skill contains references and links to official documentation from Gradle (
docs.gradle.org) and the Android Developer portal (developer.android.com). These are recognized as trusted, well-known services for developer tools and documentation. - [COMMAND_EXECUTION]: The skill includes localized scripts (
audit_build_performance.pyandrun_examples.sh) to automate the audit process on local project fixtures. These scripts perform standard file system read operations and output text-based reports without accessing sensitive directories or performing network operations.
Audit Metadata