play-billing-upgrade
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell commands to verify project compilation and test results during the migration process. These include
./gradlew assembleDebug,./gradlew test, and./gradlew build. These are expected behaviors for an Android development and validation tool.- [EXTERNAL_DOWNLOADS]: The skill references migration guides, release notes, and documentation from official sources such as developer.android.com and the android/skills repository on GitHub. These references are used solely for informational purposes to guide the refactoring logic.- [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface because it reads and analyzes existing project code and configuration files. - Ingestion points: build.gradle, build.gradle.kts, libs.versions.toml, and project source code.
- Boundary markers: No explicit delimiters or instructions are used to distinguish untrusted source code from the agent's internal instructions.
- Capability inventory: The agent has capabilities to modify local files and execute shell build commands.
- Sanitization: The skill relies on intent-based refactoring logic, which involves analyzing the code structure before applying changes, acting as a functional filter.
Audit Metadata