gooserelayvpn-android-client
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands to build the Android application and its Go-based components, including running 'bash android/build_go_mobile.sh', './gradlew assembleDebug', and 'gomobile bind'. These operations are expected for a development-oriented skill and align with its stated purpose.
- [EXTERNAL_DOWNLOADS]: The project fetches the 'gomobile' tool from 'golang.org' and pulls the core VPN logic from a GitHub repository ('github.com/Hidden-Node/GooseRelayVPN/client') using the Go module system. These are standard dependency management practices.
- [INDIRECT_PROMPT_INJECTION]: The skill processes profile configuration data in JSON format, which represents a potential attack surface. 1. Ingestion points: JSON profile import in the Android application and the Start function in 'mobile/mobile.go'. 2. Boundary markers: No explicit delimiters or safety instructions are mentioned for the JSON fields. 3. Capability inventory: The application interacts with the Android VpnService API and executes Go code via JNI. 4. Sanitization: The skill uses structural validation via Go's 'json.Unmarshal' but lacks content-specific sanitization.
- [SAFE]: The skill involves building a censorship-circumvention tool, which is a legitimate use case. It provides clear instructions and uses well-known development tools without signs of obfuscation or malicious intent.
Audit Metadata