skills/openharmonyinsight/openharmony-skills/android-to-harmonyos-migration-workflow/Gen Agent Trust Hub
android-to-harmonyos-migration-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Android source code and resource files as its primary input across multiple agents (Analyzer, Translator, Feature Comparator).
- Ingestion points: The scripts
analyze.py,migrate.py, andcompare_features.pyread content from user-specified directories containing Java, Kotlin, and XML files. - Boundary markers: There are no explicit boundary markers or instructions to the agents to ignore embedded text that might mimic migration instructions within the source code comments or strings.
- Capability inventory: The workflow includes the ability to write files (
migrate.py) and execute shell commands to interact with connected devices viahdc(UI_COMPARE.md). - Sanitization: Input data is processed primarily via regular expressions for pattern matching and substitution without robust sanitization of potentially malicious prompts embedded in source files.
- [COMMAND_EXECUTION]: The skill relies on shell command execution for its core functionality, specifically for building, installing, and launching applications on HarmonyOS devices.
- Evidence:
SKILL.mdandUI_COMPARE.mddocument the use ofhdc shell aa startand otherhdc(HarmonyOS Device Connector) commands to automate application testing. TheUI_COMPARE.mdfile provides a Python example usingsubprocess.run(cmd, shell=True)to execute these commands. - [EXTERNAL_DOWNLOADS]: The documentation for the UI comparison agent suggests downloading an external library for visual validation.
- Evidence:
UI_COMPARE.mdsuggests runningpip install Pillowto enable screenshot comparison functionality in thecompare_ui.pyscript.
Audit Metadata