limrun-gradle
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's primary function is to synchronize local source code and execute build tasks (Gradle, NPM, etc.) on a remote sandbox environment via the
lim gradle buildandlim gradle runcommands. - [INDIRECT_PROMPT_INJECTION]: The skill processes local project files which are then synced and executed in a remote environment. This creates a surface for indirect injection if the project files contain malicious instructions.
- Ingestion points: Syncs the current directory (local project files) to the remote sandbox.
- Boundary markers: None explicitly defined for the synced content.
- Capability inventory: Execution of Gradle tasks,
npm,pnpm,yarn,bun, and arbitrary shell commands vialim gradle runon the remote instance. - Sanitization: Relies on the isolation of the remote sandbox environment provided by the service.
- [EXTERNAL_DOWNLOADS]: The skill references the installation of the
limCLI tool via NPM and a GitHub action from the vendor's repository. - Evidence:
npm install --global limandhttps://github.com/limrun-inc/android-preview-action. - Context: These resources are owned by the skill author (limrun-inc) and are part of the intended setup process.
Audit Metadata