The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/devmatrix.py interacts with Android devices by executing adb and aapt2 commands. It also invokes a sibling skill script, uia.py, from the android-ui-driver skill to capture UI snapshots. These operations are essential for the skill's purpose and are implemented securely using subprocess.run without a shell and with proper argument quoting via shlex.quote.
[DATA_EXPOSURE]: To perform capability analysis, the tool pulls the APK file of the target application from the device into the host's temporary directory for inspection. It also captures UI snapshots and screenshots to identify layout failures. This data remains on the local environment and is used solely for generating the testing report.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of the Android application's accessibility tree (UI text and descriptions). While this constitutes an attack surface for indirect prompt injection (where malicious text in an app could attempt to influence the agent reading the report), the script mitigates this by using repr() formatting for element labels in its output, ensuring that UI content is clearly delimited as data.

android-device-matrix