The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/apkscan.py invokes external CLI tools such as aapt2, apksigner, jadx, bundletool, apkid, and apkleaks using subprocess.run. The implementation uses list-based arguments to prevent shell command injection.
[EXTERNAL_DOWNLOADS]: The skill's instructions and script logic reference the use of external tools and Docker images (specifically exodusprivacy/exodus-standalone). These are recognized security utilities provided by established projects.
[PROMPT_INJECTION]: The skill processes untrusted input in the form of Android binaries, creating an indirect prompt injection surface where malicious app metadata could attempt to influence the agent. The skill includes built-in mitigations such as zip entry limits to prevent zip bomb attacks and an analysisCaveats reporting mechanism to ensure the agent is aware of tool limitations and potential data gaps.

android-apk-analysis