anubis-android-app-manager
Warn
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
ShizukuUserServiceimplementation facilitates the execution of arbitrary shell commands viaRuntime.getRuntime().exec(arrayOf("sh", "-c", command)). Variables such aspackageName,action, andreceiverClassare directly interpolated into these commands without sanitization, creating a risk of command injection if malicious strings are provided. - Evidence:
service?.executeCommand("pm disable-user --user 0 $packageName")inFreezeManager.kt. - Evidence:
service?.executeCommand("am broadcast -a $action -n ${config.packageName}/${config.receiverClass}")in the VPN control logic. - [EXTERNAL_DOWNLOADS]: The skill directs users to clone and build a project from an external, untrusted source at
https://github.com/sogonov/anubis. - [PRIVILEGE_ESCALATION]: The skill utilizes the Shizuku API to bypass standard Android application sandboxing, gaining shell-level permissions to modify system states and interact with other applications in ways normally restricted to the system or a user with ADB access.
- [DYNAMIC_EXECUTION]: The skill constructs and executes shell scripts at runtime using string concatenation. This dynamic assembly of executable commands combined with high-privilege access is a significant security risk if inputs are not strictly validated.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits a vulnerability surface where it ingests external data (such as custom VPN configurations or package names) and processes it through high-privilege shell execution. There is a lack of boundary markers or sanitization logic to prevent embedded instructions in this data from hijacking the shell process.
Audit Metadata