testing-compose-in-release-mode
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard shell commands for building Android projects (
./gradlew :app:assembleRelease) and inspecting build artifacts (ls,cat). These are routine development operations used to access performance reports. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to process data from external files such as Compose Compiler reports (
.txt,.csv,.json). - Ingestion points: Files in the
app/build/compose_compiler/directory. - Boundary markers: None explicitly defined in the prompts.
- Capability inventory: Limited to local file inspection and Gradle build triggers.
- Sanitization: No specific sanitization logic is provided for these reports.
- This constitutes a minor risk where malformed reports could influence agent diagnostics, but it is typical for performance analysis tasks.
Audit Metadata