The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the trace_processor binary from https://get.perfetto.dev/trace_processor and multiple helper scripts (e.g., java_heap_dump, record_android_trace) from https://raw.githubusercontent.com/google/perfetto/main/tools. These downloads target official and trusted Google domains.
[REMOTE_CODE_EXECUTION]: The skill executes the downloaded trace_processor binary and helper scripts after setting executable permissions via chmod +x. While the sources are trusted, this represents a remote-to-local execution pattern.
[COMMAND_EXECUTION]: The skill frequently uses shell commands to manage the profiling environment, including starting background servers (trace_processor server unix), executing SQL queries, and running recording scripts with user-supplied arguments like package names.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, potentially untrusted Android Perfetto trace files to perform analysis. This creates a surface for indirect prompt injection.
Ingestion points: External trace files (paths or URLs) are ingested in perfetto_trace_analysis.md and triage.md.
Boundary markers: There are no explicit delimiters or instructions for the agent to ignore potentially malicious instructions embedded within the trace data or metadata.
Capability inventory: The skill has the capability to execute shell commands, run SQL queries, and write analysis reports to the file system.
Sanitization: There is no evidence of sanitization or strict schema validation for the ingested trace data before it is processed by agent-generated SQL queries.

android-profiler