android-modernization-upgrade
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local utility script (
scripts/scan_project.py) from withinscripts/generate_remediation_checklist.pyusingsubprocess.run. This is a standard modular implementation for processing project metadata and does not involve high-risk command strings or shell injection vulnerabilities. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted source code and configuration files from the user's project directory to identify modernization needs. While this provides a data ingestion surface, the risk is minimal because the processing logic relies on deterministic string replacements and hardcoded technical signatures rather than passing raw untrusted data into sensitive agent operations.
- Ingestion points: Project-wide file scanning in
scripts/scan_project.pyandscripts/apply_safe_upgrades.py. - Boundary markers: Not present.
- Capability inventory: Local file modification and script execution.
- Sanitization: Constrained regex matching for known Android technical markers.
- [SAFE]: External references are limited to official Android developer documentation and well-known Google service domains, which are trusted sources for platform-specific upgrade guidance.
Audit Metadata