hz-android-2d-porting
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill suggests using the
npx -y metavrcommand to run the Quest device CLI tool. This pattern fetches and executes themetavrpackage directly from the npm registry without manual installation. In this context, it is a standard developer workflow for running platform tools. - [EXTERNAL_DOWNLOADS]: The instructions reference several external dependencies, including Meta SDKs (Spatial SDK, Platform SDK) and standard Android libraries (AndroidX, Material Design). These are hosted on well-known, legitimate package registries such as Maven Central and Google's Maven repository.
- [COMMAND_EXECUTION]: The skill provides commands for interacting with a connected Quest device via the
metavrCLI (e.g.,metavr app install,metavr app launch, andmetavr adb logcat). These are expected operations for a developer tool focused on application testing and deployment.
Audit Metadata