android-to-harmonyos-migration-workflow

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Android source code and resource files as its primary input across multiple agents (Analyzer, Translator, Feature Comparator).
  • Ingestion points: The scripts analyze.py, migrate.py, and compare_features.py read content from user-specified directories containing Java, Kotlin, and XML files.
  • Boundary markers: There are no explicit boundary markers or instructions to the agents to ignore embedded text that might mimic migration instructions within the source code comments or strings.
  • Capability inventory: The workflow includes the ability to write files (migrate.py) and execute shell commands to interact with connected devices via hdc (UI_COMPARE.md).
  • Sanitization: Input data is processed primarily via regular expressions for pattern matching and substitution without robust sanitization of potentially malicious prompts embedded in source files.
  • [COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality, specifically for building, installing, and launching applications on HarmonyOS devices.
  • Evidence: SKILL.md and UI_COMPARE.md document the use of hdc shell aa start and other hdc (HarmonyOS Device Connector) commands to automate application testing. The UI_COMPARE.md file provides a Python example using subprocess.run(cmd, shell=True) to execute these commands.
  • [EXTERNAL_DOWNLOADS]: The documentation for the UI comparison agent suggests downloading an external library for visual validation.
  • Evidence: UI_COMPARE.md suggests running pip install Pillow to enable screenshot comparison functionality in the compare_ui.py script.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:24 AM