adb-magisk-installer
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the Magisk APK and related assets from the official GitHub repository (topjohnwu/Magisk). This is a well-known and trusted project within the Android developer community. The URLs are clearly defined and point to the official repository.
- [COMMAND_EXECUTION]: The Python scripts utilize the subprocess module to interact with adb and fastboot binaries. The command invocations use structured argument lists, which prevents shell command injection and ensures that only the intended commands are executed with the provided parameters.
- [REMOTE_CODE_EXECUTION]: The skill downloads an external binary (Magisk APK) and installs it on a connected Android device. While this involves executing external code, it is the primary and documented function of the skill, and the source is verified as the official project repository.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied parameters such as device IDs and version strings. The scripts mitigate injection risks by validating local file paths and using safe execution methods for system commands. The ingestion points are bounded by the specific requirements of the ADB and Fastboot protocols.
Audit Metadata