android-emulator-skill
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
subprocessmodule to executeadb(Android Debug Bridge) commands for tasks such as app launching, screen capturing, and input simulation. This is the primary function of the skill and follows standard automation practices.- [REMOTE_CODE_EXECUTION]: Thebuild_and_test.pyscript identifies and executes thegradlewwrapper script located within the current project directory. While essential for building Android projects, this involves executing local script files which may contain project-specific logic.- [EXTERNAL_DOWNLOADS]: Throughapp_launcher.py, the skill can install APK files onto a connected device usingadb install. This enables the deployment of external binary content to the target environment.- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface inscreen_mapper.py, which parses the XML UI hierarchy of the connected device and extracts text for the agent's consumption. Maliciously crafted applications could potentially include instructions in their UI labels to influence the agent's decision-making. - Ingestion points: UI hierarchy data is retrieved via
uiautomator dumpand parsed usingxml.etree.ElementTreeinscripts/screen_mapper.py. - Boundary markers: There are no explicit delimiters or system instructions used to isolate untrusted UI text from the agent's primary instructions.
- Capability inventory: The skill possesses capabilities for command execution via
adb, file system access for APKs and XML dumps, and build automation via Gradle. - Sanitization: Element text is extracted as-is from the XML hierarchy; no specific sanitization or filtering of potentially malicious instructions within labels is performed.
Audit Metadata