The Agent Skills Directory

[PROMPT_INJECTION]: The skill includes explicit defensive instructions to counter prompt injection attempts found within audited applications. It mandates that the agent must treat all data returned by the device (screen text, screenshots, logcat) as untrusted and must never allow such data to trigger commands, purchases, or credential entry. The static detection of instruction-override patterns is a false positive, as the skill is documenting examples of what the agent should ignore rather than attempting to override the agent's own system prompt.
[COMMAND_EXECUTION]: The skill orchestrates several CLI tools and sibling skills (pkgdiag.py, uia.py, report.py) to perform its tasks, primarily interacting with Android devices via adb. The instructions emphasize the use of disposable emulators and specific serial numbers for physical devices to prevent accidental execution on unauthorized hardware. The commands used are standard for Android security auditing.
[DATA_EXFILTRATION]: There is no evidence of data exfiltration to unauthorized remote servers. The skill's reporting mechanism is designed to produce a self-contained HTML report stored locally. The script report.py explicitly avoids external dependencies like CDNs, web fonts, or tracking scripts to ensure the resulting report is private and offline-capable.
[SAFE]: The skill implements robust mitigation strategies for indirect prompt injection by instructing the agent to never execute commands based on app-provided text and by ensuring that the report generation script (scripts/report.py) escapes all external content before rendering it in HTML. The safety policy includes strong guardrails against entering credentials or interacting with financial controls.

android-app-review