hz-spatial-sdk
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses the Gradle wrapper (
./gradlew) to build Android applications, which triggers the download of the Gradle distribution and project dependencies (such ascom.meta.spatiallibraries) from remote repositories. - [REMOTE_CODE_EXECUTION]: Instructions suggest using
npx -y metavrto install and run the vendor's CLI tool if it is not available in the local path, which involves downloading and executing a package from the npm registry. - [COMMAND_EXECUTION]: The skill makes extensive use of the
metavrtool for application lifecycle management, including installing APKs (metavr app install), launching applications (metavr app launch), and viewing system logs (metavr log). - [PRIVILEGE_ESCALATION]: The skill provides commands to modify system properties on a connected Quest device using
metavr adb shell setprop, which involves privileged interaction with the target hardware's operating system.
Audit Metadata