tracing-recompositions-at-runtime
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to apply a Gradle plugin (
com.github.skydoves.compose.stability.analyzer) and a corresponding library dependency. These resources originate from the vendor's official GitHub repository and established package registries (Maven Central/Google), which is standard for Android development tooling. - [COMMAND_EXECUTION]: The skill mentions using
adb logcatto read recomposition logs from a connected device. This is a standard developer workflow for debugging Android applications. - [DATA_EXFILTRATION]: The skill notes that instrumentation captures parameter values into log strings, which could potentially include Personal Identifiable Information (PII) if sensitive data is passed to composables. However, the skill explicitly mandates a safety pattern to gate this functionality behind build flags (e.g.,
BuildConfig.DEBUG), ensuring tracing is dormant in production releases to prevent accidental data exposure.
Audit Metadata