The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/uxcheck.py script executes shell commands through subprocess.run to interact with Android devices using adb. It specifically queries wm density to convert raw pixel measurements into density-independent pixels (dp) for accurate auditing. The implementation uses a list-based command structure, which is a best practice for preventing shell injection vulnerabilities.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it processes text data and UI structures from third-party Android applications during an audit.
Ingestion points: UI snapshots (JSON files) ingested by uxcheck.py and application screenshots analyzed by the agent (referenced in SKILL.md).
Boundary markers: The references/heuristics.md file provides a structured 12-category rubric that constrains the agent's evaluation, while the workflow in SKILL.md emphasizes that findings must be evidence-backed and confirmed by humans.
Capability inventory: The skill uses adb command execution and coordinates with an external android-ui-driver tool.
Sanitization: The skill does not perform automated sanitization of UI text but mitigates risk by designating findings as "suspected" until verified manually via TalkBack or hit-area checks.

android-ux-audit