anything-to-spatial-app
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: A thorough analysis of the provided skill files identified no malicious patterns, obfuscation, or safety violations. The code and instructions adhere to secure development practices.
- [COMMAND_EXECUTION]: The skill utilizes local shell and Python scripts (e.g., 'smoke_build.sh', 'runtime_launch_check.sh') to automate standard Android development tasks. These include compiling code via 'gradlew' and interacting with hardware or emulators using 'adb'. These operations are expected for the skill's purpose and are conducted within the user's local workspace.
- [EXTERNAL_DOWNLOADS]: The skill retrieves design data from Figma via specialized MCP tools (e.g., 'd2c_get_figma_data') and manages project dependencies through Gradle, which fetches verified libraries from official Maven repositories such as Google and Maven Central.
- [PROMPT_INJECTION]: The skill processes untrusted external data including Figma URLs, screenshots, and product documentation. It successfully mitigates indirect prompt injection risks by enforcing a multi-phase structural translation (Evidence Packet -> Normalized Spec -> Layout Contract) that acts as a semantic boundary. Furthermore, Phase 7 includes mandatory validation gates that scan implementation files and verify architectural compliance before finalizing any output.
Audit Metadata