limrun-gradle

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill's primary function is to synchronize local source code and execute build tasks (Gradle, NPM, etc.) on a remote sandbox environment via the lim gradle build and lim gradle run commands.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes local project files which are then synced and executed in a remote environment. This creates a surface for indirect injection if the project files contain malicious instructions.
  • Ingestion points: Syncs the current directory (local project files) to the remote sandbox.
  • Boundary markers: None explicitly defined for the synced content.
  • Capability inventory: Execution of Gradle tasks, npm, pnpm, yarn, bun, and arbitrary shell commands via lim gradle run on the remote instance.
  • Sanitization: Relies on the isolation of the remote sandbox environment provided by the service.
  • [EXTERNAL_DOWNLOADS]: The skill references the installation of the lim CLI tool via NPM and a GitHub action from the vendor's repository.
  • Evidence: npm install --global lim and https://github.com/limrun-inc/android-preview-action.
  • Context: These resources are owned by the skill author (limrun-inc) and are part of the intended setup process.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 02:13 AM