sparkscan-android
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill retrieves the latest SDK version metadata from Maven Central (central.sonatype.com), a well-known service for Android library distribution, to ensure the project uses up-to-date dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves reading and acting upon the content of local project files, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: The agent reads the project's build.gradle, gradle/libs.versions.toml, and Kotlin/Java source files to determine the current SDK state and apply migration logic.
- Boundary markers: The skill does not provide specific instructions to the agent to treat local file content as untrusted data or to ignore instructions embedded within it.
- Capability inventory: The skill utilizes the agent's ability to read from and write to the local file system to automate the integration process.
- Sanitization: No sanitization or verification logic is applied to the content extracted from the project files before it is processed by the agent.
Audit Metadata