The Agent Skills Directory

Integrity Verification: The skill implements mandatory SHA-256 checksum verification for both the Gradle distribution and the Gradle wrapper JAR before they are executed. This is a robust security measure designed to ensure that the build environment has not been tampered with and that downloaded artifacts match their official, intended versions.
External Resource Acquisition: The skill fetches the Gradle build tool from official domains (services.gradle.org). This is an expected and necessary behavior for build automation, and the use of well-known, legitimate infrastructure reduces the risk of sourcing compromised tools.
Staged Execution Environment: All compilation and binary transformation tasks are performed within a dedicated staging directory (ppmplugin/staging/android-build/). This approach ensures that the primary project files remain unmodified and protected from potential side effects or configuration changes that occur during the build process.
Targeted Tool Invocation: The skill identifies the absolute paths of required Android SDK tools (such as d8) rather than relying on the global system PATH. This specificity prevents the accidental execution of shadowed or incorrect versions of binaries that might be present on the host system.
Source Validation: Before initiating the build, the skill performs several checks on the Kotlin source code to ensure it meets specific runtime requirements. These checks prevent the deployment of binaries that would fail to load or behave incorrectly at runtime due to incompatible annotations or missing constructors.

build-android-binary