android-security-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official Android security documentation and tools from developer.android.com and google.com. These are trusted sources provided by the platform vendor.
- [INDIRECT_PROMPT_INJECTION]: The skill audits external code files in the examples directory using ripgrep. Although it processes external data which could theoretically contain malicious instructions, the utility used for analysis is a non-executing search tool, and the risk is minimal and inherent to the auditing function.
- [COMMAND_EXECUTION]: The skill workflow involves executing standard development commands such as ripgrep for static analysis and gradlew for building example projects. These are expected tools in the Android development ecosystem. The skill also references a local script scripts/eval_triggers.py for trigger evaluation.
Audit Metadata