android-native-dev
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill includes standard developer commands for building Android applications using the Gradle wrapper (e.g.,
./gradlew assembleDebug) and interacting with connected devices or emulators through the Android Debug Bridge (e.g.,adb shell am start). These are routine operations for Android development. - [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted Android libraries from the official Google and AndroidX ecosystems (e.g.,
androidx.compose:compose-bom). These resources are from established vendors and are considered safe for development purposes. - [PROMPT_INJECTION]: The skill presents a potential indirect prompt injection surface because it instructs the agent to analyze and complete user-provided project files while maintaining shell execution capabilities (Gradle and ADB). 1. Ingestion points: Project scenario assessment and file checklist in
SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Shell execution via./gradlewandadbcommands. 4. Sanitization: Absent. This vulnerability surface is inherent to the primary purpose of a developer-oriented skill and is mitigated by the skill's own emphasis on security practices.
Audit Metadata